To prevent incoming connections you don't want.

I would say that most people would have this handled at the hardware router level. Users who have a wireless LAN already have a firewall for incoming connections (unless they have DMZ enabled). Software firewalls are useful when you want to control what connects to the Internet and when.

If someone else on your LAN gets infected because they opened an email virus, your router isn't going to help you.

Make applications on your machine comply to whatever network policy you have? I honestly don't want to have to whitelist every single one program I run to be able to do access the network. Do you?

I'm also pretty sure changing firewall-rules requires administrator priveledges, and hence it's no different than it is on Linux. Except ofcourse on Linux, the firewall isn't application-aware, so you can't even control which processes are allowed to open inbound communication.

This really is a lot of noise over nothing.

> Except of course on Linux, the firewall isn't application-aware, so you can't even control which processes are allowed to open inbound communication.

You certainly can set application-level network privileges, and Red Hat derived distros do by default. For example, to list all the applications that are allowed to bind to port 80:

  [sweeks@kweh ~]$ sudo sesearch --allow -t http_port_t -p name_bind
  Found 15 semantic av rules:
     allow httpd_t http_port_t : tcp_socket { name_bind name_connect } ; 
     allow kerneloops_t http_port_t : tcp_socket { name_bind name_connect } ; 
     allow varnishd_t http_port_t : tcp_socket { name_bind name_connect } ; 
     allow dnsmasq_t port_type : udp_socket { recv_msg send_msg name_bind } ; 
     allow svirt_t port_type : tcp_socket { name_bind name_connect } ; 
     allow svirt_t port_type : udp_socket { recv_msg send_msg name_bind } ; 
     allow squid_t http_port_t : tcp_socket { name_bind name_connect } ; 
     allow corenet_unconfined_type port_type : tcp_socket { recv_msg send_msg name_bind name_connect } ; 
     allow portreserve_t port_type : tcp_socket name_bind ; 
     allow corenet_unconfined_type port_type : udp_socket { recv_msg send_msg name_bind } ; 
     allow portreserve_t port_type : udp_socket name_bind ; 
     allow varnishd_t port_type : tcp_socket { name_bind name_connect } ; 
     allow qemu_t port_type : tcp_socket { name_bind name_connect } ; 
     allow qemu_t port_type : udp_socket { recv_msg send_msg name_bind } ; 
     allow squid_t port_type : tcp_socket { name_bind name_connect } ;

Any processes running under other domains won't be allowed to bind to port 80.

> I honestly don't want to have to whitelist every single one program I run to be able to do access the network. Do you?

Yes. How many programs do you have accessing the internet? I don't think that I've used, total, more than 10 or 11 programs that need internet access (and it's probably more like 3 or 4 for any given year or so); and I can live with that kind of one-time bother in exchange for knowing that other processes aren't chatting about me without my knowledge.