In a well-designed operating system with adequate maintenance, there is no process which runs and offers services and implies various activities except those that are strictly necessary for what the system administrator and user intend the machine to do.
Unfortunately, desktop OS have grown way past the point where such an efficient simplicity could be realistically achieved. You have to cope with OS including a lot of undocumented elements and activities, some of which implying network activity, in particular listening to incoming requests on some port and thus offering a service to outsiders. It is a good idea to make an inventory of what is running on your machine and try to track such unwanted elements (look at the list of process, also see the open ports with
netstat -a, and so on).
However, it is also a good idea to enforce a strict in/out policy for everything related to networking, in case you did not make a full cleansing. A firewall is something which enforces this in/out policy. Your external hardware firewall will trap all activity which goes through it but it may not see activity related to the local network (and Windows systems do that a lot, with all the NetBIOS stuff). A local firewall, being local, can see every single byte that enters of exit the machine, so it is more thorough for detecting unwanted activity.
On the other hand, an external firewall will be more efficient at blocking attacks which target the implementation of low-level network protocols directly; the local firewall gets to act only after the IP packet has been received and some processing already occurred in the OS kernel, so it is a bit too late for the kind of attack which exploits buffer overflows in the kernel. In that sense, the external firewall and the local firewall complement each other. They both can do things that the other cannot, even though there is some partial overlap in their respective functionalities.