External firewalls offer some protection but in today's widespread spyware/malware problems external firewalls don't offer the kind of protection you really need. As a matter of fact, outbound connections from your desktop is what you should be concerned about most. For instance...say a connection from your machine is initiated to a destination IP on port 80. An external firewall won't be able to tell what application initiated that connection. Whereas a personal firewall running on the desktop could have the ability to tell which app initiated the connection, whether or not the connection was initiated as a result of code injection, launching another application, etc. Many spyware/malware/adware exploits rely on being able to perform any/all of code injection, spawning other apps to access the internet, or directly access the internet. An external firewall can't help at all unless you're willing to add a rule to every possible destination you could visit and that of course is not practical. Whereas with a personal firewall you can restrict which applications can access the internet, whether or not these apps can launch other apps, or be allowed to do a code injection to access the internet.
I've used Norton, Kerio, MS firewall, Tiny, and Zone Alarm. My personal favorite is Tiny Personal firewall. Sometimes I switch to Kerio but as of today it comes a close 2nd which is to say they're both good. Zone Alarm I wouldn't trust as far as I can throw it anymore ever since Checkpoint bought them. I will never trust a "firewall" that spies on me and calls home like ZA does. And Norton..well...let's just say that your CPU won't be idle too often. Its a hog
Tiny/Kerio are not free but in my opinion are worth the money. You can try evals of either to get an idea of how well they work. You'll be surprised to see what and how many apps try to initiate connections outbound. It is an eye opener.
So the bottom line is you need a solid personal firewall (one that runs on your desktop) to protect from the inside out and you could get an external firewall to protect from the outside in.
Casey