I just bought a new router, and as usual the router manufacturer make a big deal out of the firewall.
I have never understood why the firewall is needed, sure, stopping dos attacks (such as syn-floods) is great, but that's the only useful thing I can think of.
As long as the services I expose to the external interface (by manually adding nat-entries) haven't got unpatched exploits isn't my lan already secure against external agents?
Please read the following previously asked questions:
They answer all of your questions.
The short version is:
NAT does not automatically imply that all inbounded connections are blocked. NAT and firewalls are, in principle, orthogonal. Generally speaking, most NAT boxes also happen to provide some firewall-like protection: they tend to block incoming connections. This is not an inherent or necessary property of NAT; it is just that most consumer devices that provide NAT also happen to provide this sort of firewalling as well.
Blocking inbound connections (whether you want to attribute it to the firewalling functionality or the NAT functionality) provides a basic level of defense that works pretty well against a common class of attacks. That makes it a good thing.
No, neither a firewall nor a NAT implies that your network is totally secure against external agents. Blocking inbound connections provides a level of defense against certain attacks, but not by any means all attacks.
But you really need to read the prior answers. I'm not going to repeat all of the excellent points made there.
You, in effect, already have a (poor form of) firewall by relying on port address translation. I am assuming you are truly doing port address translation by the contents of your post. The question you are then asking is why do I need a firewall for my firewall. If you do have network address translation, you are not just exposing specific services to the external interface. You would be exposing an IP externally thereby having no control over what services may be accessed.
So to answer your question, if you are doing port address translation and exposing only patched specific services to the internet why do you need a firewall? You do not.
If you are asking why would I need to restrict which ports and address are directly routeable from the internet into my network, well... I really can't help you there.
There is a pretty big difference between NAT/PAT and a firewall capable of doing stateful packet inspection.
A decent firewall can actually tell if an incoming packet was unsolicited or if it was requested by an inside host, this will keep out a lot of unwanted traffic from port scanners and other intrusion attempts.
They are also protocol aware and can handle stuff like FTP traffic, which starts on port 21 but then listens on random higher level ports.
They may also provide other services such as VPN, content filtering, and can log traffic for auditing purposes.
