At first, I liked that firewall argument – I’m all for no configuration if possible. But if installing a service just means doing a simple package install, then it gets weaker – I installed Apache and MySQL over the weekend, and if I didn’t have the router in place protecting me, I’d be thinking twice about doing that without a firewall. (Though with my current configuration, I’m using Apache over a LAN, but the argument would apply if I only had one computer and no router.)

And, even setting aside my eroding iptables skills, it’s not like it’s that braindead easy. Aside from taking the time to learn the syntax and making your first mistakes (and hoping that the mistakes aren’t of the form of inadvertently leaving a hole open), there are interactions with nameservers and NTP servers that, in my past experience, require more coordination than you want to do by hand.

Ubuntu doesn’t ship with a firewall, because it doesn’t ship with any externally-accessible services turned on — and the idea is that if you’re competent enough to set such a service up, you can handle providing an iptables rule for it too.

I tend to find firewalls to be nuisances, but I also tend not to run insecure services.