What's the point of a firewall?

I think it's needed only for complex networks where e.g. services are
accessible from some but not all hosts. For a simple desktop computer,
everything listens only for local connections or isn't installed. (Some
programs imo need a nondefault configuration: OpenSSH shouldn't allow
password authentication.) All uses of firewalls that I know need
system-specific configuration, not a default.

Even if there are services available from other hosts, firewalls of your
router and your ISP might prevent them from being accessed.

(I don't have any professional experience nor qualifications related to
networking.)

Well,

This is, indeed, a really good subject.

This can be misunderstood as not-useful for the majority of the GNU+Linux users but, let's pretend that Some User One has a GNU+Linux operating system, and that Some User Two has any operating system and is in the same local network as Some User One.

Let's pretend that Some User One must be (that means, he's obliged to do so) running a SSH server, and a SMB server, both running on his operating system. Everything is OK for both users because they have everything that they desired.

Now let's pretend that, by a bit of luck, a black hat hacker or an Internet robot finds the IP address of Some User One's computer. In the case of a black hat hacker, he could try to break the security of the SSH server; as for the Internet robot, this one would just try random stuff gathered from previously infected/invaded victims to break the security of the SSH server.

I don't know for sure why I mentioned the SMB server, but perhaps, depending on which contents the SMB server shares, it's possible for the black hat hacker to get some confidential information about anyone, or even transfer some malicious software to those who joined the network in question.

A firewall, along with an automated banning tool and strong security measures can solve a lot of problems.

With a firewall, Some User One could block connections from people from outside his local network by using the correct classless inter-domain routing notation for his network.

If a firewall is able to, besides filtering ports, also filter the protocols associated to those ports, the situation gets even more secure because the firewall will, most of the times, block a wrong request if its protocol doesn't match the protocol associated to such port.

If the user's computer has an automated banning tool, it'll ban the incoming user automatically if its connection reaches a certain criteria.

Michal Maslowski is indeed right.

My comment (this one) is just based on life experience, not on knowledge or skill about such subjects.

Best regards, ADFENO.
Have a nice day.

If you aren't running any public server — there is no point in firewall. If you want to keep the only default server (ssh) — just use fail2ban and forget about it.

The iptables capability which is what the kind of firewall you talk about uses is built into the kernel. Just it isn't set up to deny ports by default in Trisquel.

Trisquel does, however, ship with an Application Level Firewall enabled by default - AppArmor [1]. This protects you if something like Samba or CUPS falls to an external attack by preventing access to files on a different level than GNU/Linux file permissions allow.

The perceived need for IP firewalls in desktop O/Ses seems to have been conditioned by the fact they're essential in a certain well known OS which is derived from a clone of CPM for the 8086.

As you observe closing umanned ports is not a real security benefit as far as typical desktop / laptop use is concerned. However, I run an IP firewall, ufw, not for the port blocking but to rate limit the number of connections per 30 seconds to the SSH port. I also set my computers not to allow password access via SSH. These significantly put up the time for an attack to succeed. I chose this as I routinely use a public WiFi which is misconfigured (no client isolation) and there's another patron who is a Script Kiddie. His eyes get very still and he doesn't blink when people type passwords around him. YMMV.

[1] https://en.wikipedia.org/wiki/Application_level_firewall

The point is Security and Control.

With other words, the firewall is a tool that can do some good to people who know what they are looking for. Who are able to download from the repositories their interface of choice. For the regular user NoScript has far better results, making it more interesting to come preinstalled than a firewall app.