ZoneAlarm and friends also block inbound traffic, so for regular users you shouldn't need an external firewall, unless you have a LAN. Then an external firewall would be the best... I would recommend ClarkConnect, also a GPL Linux-based firewall.

Stig