When I say firewall, I mean a physically separate box.
Broad band routers are not firewalls, but they refuse incoming connections by default, so they are already a very good protection measure.

The windows software firewall is better than nothing, but not that great either. For that matter, any software based firewall is inherently susceptible to attack.

Physical firewall boxes are much better, because they allow you restrict traffic fairly easy, based on direction (in / out) IP addresses, port numbers and protocol. Once that is done, nothing on your computer can change it. And these things are hardened against attack so much that they are inpenetrable for all intents and purposes.

The disadvantage is that they cost a couple of bucks (low end juniper is a couple of 100) and you have to understand TCP/IP pretty well in order to configure them correctly. But they are infinitely more secure than anything software based.