you should definitely have a firewall but the security advantages of a VPN are questionable, pushed hard by VPN vendors, who are biased due to what they're selling. They're useful for evading DMCA takedowns but that's not about keeping hackers off your machine.