said by docrice :

There are places for both hardware and software firewalls, and they both come in varying degrees of quality and effectiveness. Software firewalls on individual hosts are important (especially on laptops) to protect you on public networks such as hotspots. Some of them might even map processes to application executables and permit outbound traffic from ones on an authorized list. It's a little more work up-front to ensure you have a good rule base, but it's worth it in the long run because for most people it's the only way they'll ever know if an application is trying to send traffic out (or if there's an attempted inbound connection). If you're curious, you could also use TCPView or fport to see what kind of TCP / UDP connections are happening real-time, although these don't filter traffic.

said by docrice :

Hardware firewalls, on the other hand, protects the your entire internal network from external networks. However, it doesn't protect internals hosts from each other. Hardware firewalls (at least the more expensive ones) are capable of deep-packet / application-layer inspections (e.g., Check Point's SmartDefense in FW-1) which examines each individual packet's payload data. For example, SMB or RPC traffic is inspected for protocol compliance and if not, drops them to prevent attacks which rely on "tweaking" the protocols to produce an exploit which may exist on the host. Inbound HTTP requests to your web server or DoS flooding are other examples of where a high-grade hardware firewall with specialized functions comes in handy.

said by docrice :

That said, most home-grade hardware firewalls (typically on all-in-one routers) don't do much more than port-level filtering.

said by docrice :

You can always use a Linux distro specific to this purpose (or something like OpenBSDs' pf) if you want a free (but very effective) hardware solution that stands guard at the edge of your network.