By preventing connections from being initiated by from your Web server, you can prevent it from becoming the source of a potential attack. This is a very simple example. Firewalls are not a simple plug-in solution. A misconfigured firewall may actually be worse than no firewall at all. Firewalls won't protect your network from a modem listening for incoming calls on your desk.
Firewalls require diligence.
You must monitor the firewall logs, keep track of security updates, and make sure you stick to your firewall policy. Investigating your system requires that you think like an intruder and learn how they work. Reviewing your security policy and auditing your system for potential vulnerabilities is a mandatory step toward securing your machines and network. By checking your system for vulnerabilities, configuration problems, and exposure, you can get an idea of what an intruder would find.