I've spent some time searching this question, but I have yet to find a satisfying answer. The majority of answers that I have seen state something along the lines of the following:
- "It's just good security practice."
- "You need it if you are running a server."
- "You need it if you don't trust the other devices on the network."
- "You need it if you are not behind a NAT."
- "You need it if you don't trust the software running on your computer."
The only answer that makes any sense to me is #5. #1 leaves a lot to be desired, as it advocates for doing something without thinking about why you're doing it -- it is essentially a non-answer. #2 is strange -- why does it matter? If one is hosting a webserver on port 80, for example, they are going to poke a hole in their router's NAT at port 80 to open that server's port to the public. What difference does it make to then have another firewall that needs to be port forwarded? #3 is a strange one -- what sort of malicious behaviour could even be done to a device with no firewall? If you have no applications listening on any port, then there's nothing to access. #4 feels like an extension of #3 -- only, in this case, it is most likely a larger group that the device is exposed to. #5 is the only one that makes some sense; if you install a program that you do not trust (you don't know how it works), you don't want it to be able to readily communicate with the outside world unless you explicitly grant it permission to do so. Such an unknown program could be the door to get into your device, or a spy on your device's actions.
If anything, a firewall only seems to provide extra precautions against mistakes made by the user, rather than actively preventing bad actors from getting in. People seem to treat it as if it's acting like the front door to a house, but this analogy doesn't make much sense to me -- without a house (a service listening on a port), what good is a door?
My setup is pretty basic, only thing I have is a media server accessed locally, and a pi running pihole and pivpn that has a port forwarded on my router for remote access. The pi has password login disabled, and the port forward is set to the static IP set for the pi with my router. The router has the firewall set, but nothing on any other machine. Do I need more?
What service do you have forwarded? Do you have any devices on your lan you don't 100% trust?
I have a similar set up only forwarding a wire guard vpn port. I live alone and fully trust every device on my LAN, so I let my router take care of the firewall and dont have any firewalls on the devices on my lan.
Some will still argue this is bad practice but I really have no desire to toggle firewall rules every time I want to expose a port while I'm developing/testing software. If someone cracks wireguard then I don't think they will risk exposing the industry halting 0 day to run a crypto miner on my raspberry pi.
IOT and friends get the guest wifi.
This is the only thing forwarded. As for devices the worst offender would be my Roku TV but I'm not sure how much of a security threat that actually would be. More of a privacy threat, hence running pihole.
It is important to note that being unaware of something's level of security is not an argument that it is more secure, or not worthy of scrutiny.
Any way you could put the roku on guest wifi or does pihole let you block all outgoing traffic? Something like that would make me a little hesitant. My lan has my graphene os device, 3 computers running debian, and an iot smart switch I flashed myself.
Like you said, more of a privacy concern than anything.