Think of a firewall as a gatekeeper. Nothing happens or gets in or gets out without its permission. I find that very useful because:
1. It blocks the "bad" requests from accessing my computer's ports, etc.
2. Even if it gets in, most of the spyware, malware tries to track your surfing habits, passwords, etc. ... but at one point it needs to communicate that to an external server. At that point the firewall should intercept the attempt and block it.
Now, if you get a firewall pop-up saying "The IamGonnaStealYourPassword.exe program tries to connect to stealpassword.com . Allow / Block?" ... and you hit Allow ... sorry, a firewall can not beat human stupidity.
