Is there a huge need for a software FW?

I hope you have your router locked-down as well!

 

The attack on routers that I remember exploited UPnP with Flash. I seriously doubt that it will be the only one. Yes, disabling javascript will break a lot of web attacks. For that matter, you pretty much have to disable Flash and Java as well as they're both heavily exploited. While this will protect you from most malicious and compromised sites, it will also break a lot of sites or make many features on these sites non-functional. Disabling web functions like javascript, flash, etc is a tradeoff. Most users don't want to spend their time building and maintaining permission whitelists for websites.

Besides, no matter how many web functions you disable, it won't protect against the biggest problem, social engineering.

 

a software firewall is necessary when you want to gain granular control over the internet usage of your network.
granular control as in:
1) Specific port blocking
2) Blacklist/Whitelist of programs allowed to connect to the internet
3) Network restrictions
4) Web filtering
5) Network rules
6) Inbound/outbound traffic filtering

If you don't mind, then a router and WFW should suit your needs pretty well.

 

Do you have an IPv6 enabled operating system, in it's default state?
Are you operating behind a standard NAT 4 router?
Do you have any way to control IPv6 Traffic?

Are you sure you're 100% safe...

 

Code:

Is there a [B]huge need[/B] for a software FW?

-Huge Need? No.
-Partial Need? Maybe...It depends on how much Outbound control you need.

I don't use a software FW.
However, I have configured my NAT/SPI Modem-Router.

 

Huge need? Software firewall?

Let's have a look at both sides of the coin...

Source: At Least This Snake Oil Is Free

A few more links:
Deconstructing Common Security Myths
Windows Firewall: the best new security feature in Vista?

I am of the opinion that this goes to show that denying the initial execution of the unknown executables/code would probably play a more important role in a security setup. With a default-deny mechanism in place, one may argue that the need for outbound firewall is neither huge nor worth the alerts thrown at the user, more so that it can be 'bypassed'.

However, to be fair, there do exist a practical use of outbound firewall in today's context, for the majority of malware that exists. You didn't stop using your AV, HIPS, Sandbox, LV just because it doesn't catch everything, did you? Some people prefer to go by the concept of least privilege and that if there's a chance to block unneeded connections, no matter how weak the protection it provides, no matter the fact that it can be 'bypassed', then it's worth a shot....the more hurdles for the attacker, the better.

Firewall Outbound Protection: It can augment a security plan
Outbound Monitoring: catching an exploit

Having looked at both perspectives, I see a software firewall more of an additional useful addition to inform the end-user of outbound connections (not necessarily malware) and by far, it's no security panacea or an end-cure to all unwanted connections. I wouldn't depend on it to stop everything...the least of it an infection. If I were to make use of it as a security tool, it would be among the last in line of my defense setup layers...

Source: The Ultimate Firewall (by Marcus J.Ranum)

P.S.Some users have the misconception that they can willy-nilly execute an infected file (with admin rights) hoping that their firewall would kick in, without considering of the possibility that the said program/process may tamper or disable the firewall. Arguably, HIPS can play a part here to provide further self-protection (which is why you see more and more 3rd-party firewall providers bundling it...leak tests, etc etc) but I wouldn't ever make the assumption that it's impenetrable.

 

I think that's a pretty good summary. Firewalls of virtually any ilk, will not prevent a particularly well written and determined piece of rogue software, from completing it's task, even on a well configured firewall, with well crafted rules and configuration change password protection. On a firewall without those, well...

The choice of whether or not to use a software firewall, will ultimately come down to your particular requirements, environment and ways of working. If you have a well configured NAT router with SPI and you have little concern about the outbound connectivity of the processes and applications on your PC(s), then you probably won't want to implement a firewall.

If, on the other hand, you do wish to have some interaction/control with observable outbound connectivity, with or with out a router, then a firewall might be for you.

As a final consideration, if you have a native or tunnelled IPv6 address, which you are using in conjunction with a NAT 4 router, even if it has IPv6/ip6tables support, but is running a 2.4 without ip6tables 'state', then you probably don't have much, if any, control over both inbound and outbound IPv6 traffic. You could, of course, implement an IPv6 enabled firewall