A firewall is for blocking / limiting access to specific service / port.
I know that it can be useful for allowing only certain IPs to a port (for example I don't want to have SSH open for the whole world).
Imagine that I have server that is running apache2 (port 80 & 443), SSH (port 22), mysql (it is bound to localhost, so it doesn't listen on a public interface).
Why should I even care to block all other ports except 22, 80 and 443, if there is no other service listening on it (for example on port 8080)?
Can someone explain this to me?