Yep, [A3D]Hatswitch has it right. The NAT of the hardware firewall is fairly good at stopping incoming probes, but a good software firewall will stop any nasties that YOU accidentally infect your system with from doing an E.T. and phoning home.

Just realise that no combination of hardware/software firewalls, intrusion detectors or anything is completely foolproof. There is always a risk. You just need to balance the risk.

Cheers
Mick