There is no reason not having a firewall

Yes, and hopefully you will have one preinstalled, blocking all incoming connections.

An outbound firewall like Opensnitch or Portmaster is also nice. But here I would say often you dont need one. Balena Etcher was the only App loading Ads, at all. Firefox and Thunderbird can be hardened. The rest is okay and doesnt phone home, Flatpak permissions ard also great.

On a laptop absolutely. My firewall on my laptop doesn’t let me discriminate between networks so I’m always worried someone will try to attack me on public WiFi for the few ports I want open

On a desktop on a network you trust less important but still no firewall means if another device on your network gets compromised you’re screwed

Ironically enough if you do not know what a firewall actually does (and saying it “protects” against "stuff is NOT enough) IMHO you do need one. That being said unless you know what you are doing, better leave it to the default one with default settings.

No - If you are aware which programs open incoming ports. E.g. check with netstat -tulpe

Yes - If you want to make sure e.g. TCP port 22 or a webserver on 443 etc is only available from IP/Adapter xy. Or if you want to mess with filtering outgoing connections.

I’d say if you plan on using it any public places, or if you don’t have full control over all the computers/technology in your home network, it’s a good idea to run one. It’s a nice last resort should someone on the same lan have a piece of malicious software.

Its always a good idea. I have a firewall on my laptop since I travel and connect to many different networks.

I don’t run any services that would be broadcasting open ports but its always better to be safe

You most likely already have one installed, but not enabled. It doesn’t harm anything (maybe you need to allow traffic to ssh or other configuration, but after that you’re all set) and it’s a layer of protection, specially if you need to move between networks (public wifi etc).

Yes, because you can forget what services are running and maybe they can be explited.

An example can be Syncthing which setting are done via web browser at port 8384. If you do not have a firewall, everyone on the same network would be able to change Syncthing settings and then sync your directories to their devices.

Eh, the router acts like one. I have no open ports. On a laptop you use on the go I would use a firewall tho.

I still don’t know what a firewall actually does lol. I just install nftables and ufw and hope it somehow improves my security. I just don’t know how.

i dont even undedtsand what a firewall is, i yhinm it blocks incouming / ourgojng connectikns lol

No, you don’t. But it’s also not necessarily a bad idea if it’s not going to create issues for you.

Normally, a software package that wants to talk over IP and only wants to let local software communicate with it can listen only on loopback addresses (like 127.0.0.1). But I have definitely seen software packages that have defaulted to listening to the world (gpsd used to do this by default, for example, which would let anyone in the world who could talk to your machine see precisely where you were). Having a firewall makes the default to be secure – you know that the default is not to be reachable, regardless of what some software author thinks is a good idea.

Most home systems these days are generally behind a NATting router, which effectively firewalls them against the outside world (though maybe IPv6 will change this), so they can’t be directly reached from the outside anyway, unless a user has set up port forwarding on the router, the systems are effectively firewalled anyway, unless an attacker can get inside the network somehow.

It’s one more thing that you’re going to have to remember to deal with if you’re installing software and troubleshooting network problems. You install software package X and it isn’t reachable, you’re going to have to figure out how to diagnose problems. As long as this isn’t a problem for you…shrugs

I don’t personally run firewalls on my desktops. But I have also, over the years, occasionally checked netstat -ntap and discovered that a service that I thought only listened locally was listening to the world, gpsd probably being the most-flagrant example.

If I were not behind a router, or if I were forwarding all ports to my system, I would be firewalling my desktop systems.

On a dedicated server, I’d be less worried, because I’m not normally installing tons of random software on the thing. If you aren’t going to firewall it, though, be sure that you’ve checked to see what is listening on the server.