A webserver listens on port 80 or 443. Neither port can be claimed by a normal user (no port below 1024 can). But yes if you manage more than your own user on a desktop AND these other users are not allowed to start programs on their own THEN a firewall can be helpful; but this is not a normal situation for a desktop-client, isn’t it?

So just close the ports (or more precise: Do not open them, as “closed” is the default for most software on Linux).

For what you need a firewall on a desktop-client?

Cool. Now if I could only find enough time to finish the campaign…