Not having a firewall allows any computer that can work out your current IP address to directly attack you.
With Windows OS, it can be a disaster because there are a lot more vulnerabilities discovered and Microsoft takes far too long to respond qand often their fixes do not solve the problem.
With Linux, it is less of a problem because it isn't as open to outside connections as Microsoft OSs and requires a lot more skill to use the vulnerabilities. Also, the Linux community is a lot more open and responds with fixes extremely fast. The fact that just about all Linux software and applications are open source, means that anyone can work out a fix and share it around.
Some firewalls can run applications that check stuff like email for viruses, etc, but a firewall can not run an application to detect spyware.
A good firewall can also run applications to watch your own network and report what computer and application made attempts to connect to what IP address, e.g spyware phoning home.
To me,the best firewall is a seperate L:inux computer running one. I do not currrently have a preference between the different preconfigred roll-out offerings.
Hey, I've had thirty years in IT. I know what I'm doing. I also run my own mailer, webserver, etc, etc, etc.
By talking about what I do, I'm trying to show you wat to look for in a good firewall. Things will be definitely simpler if you are just talking a computer that just surfs the web and picks up mail from your ISP.
The first thing my firewall does is decide if I even want to answer the door. I can build up a long list of UIP addresses that send virus, wors, trojans, etc and tell my firewall never to answer their knocking.
I can also build up a list of web trawlers that are know to trawl through my website and suck off all the email addresses to spam them. I can add to that list, all the IP addresses that have sent me spam in the past.
Most prepacked firewalls have restrictions on the number and range of IP numbers you can block.
By writing my own rules, I can decide how little or how much I block or allow.
E.g, i might block all IPs assigned to Russia because of russian hacker activity. My firewall would just not talk to the in any way shape or form. I'd pprobably add all IPs assigned to Nigeria and all IPs assigned to XYZ Company in Florida USA that is know to allow customers to send spam.
Firstly I do not want them trolling my website and secondly, I'm not interested in any mail from them, so I block them totally.
I might then allow every one else to look at my webserver. which is port 80.
I might have multiple webservers on different ports, like 8080 which I only open to places I am currently working, or 5670 which may only be open to relations who are working on my family tree with me.
Then I might invoke a service that tells me if this IP, that wants to connect to my mail server, has been reported as sending spam. If it has, then I'll block it. If it hasn't then I will allow it to start talking to my mail server on port 25.
Note, some mail servers that I mgith run, can also be configured to report IP numbers that sent spam and automatically add them to the blocked list.
I might have it set up so I can check home mail from outside customer sites, but instead of using the common POP3 port of 125, I'd use something else and reject all pop3 on port 125 as hacking attempts.
Perhaps I run a peer to peer server, but I want to restrict the servers/seeds that can actually talk to me on the calling port. I can do that with my own firewall rules.
Once you understand how to write firewall rules, it isn;t that hard. They just collect over time and look complex.
It really is a series of IF then, If then that stops being tested as either it is rejected and allowed.
Probably far more than you wanted to know.