In short: It's probably a good idea to run a firewall, but you might not need it if you take care not to run any servers.
The answer to this question depends. It depends on whether or not you are running server applications on your computer.
Let me explain: Often firewalls are configured to allow all outgoing traffic, but to limit incoming traffic to certain ports or certain source-IP addresses.
The reason to allow all outgoing traffic is, that it's tedious to write a comprehensive whitelist of programs and destinations that are allowed to connect, and unless there is spyware on the computer, outgoing traffic is anyhow caused by the user directly, or by a legitimate program (for instance update-manager checking for updates). In other words: laziness. This is also the default setting of the firewall that comes with Windows.
The incoming traffic is limited in order to ensure, that only certain computers can talk to certain server programs. A typical use case is a web server, where remote control access over SSH should only be allowed from computers in the same network, while the website should be visible from all any computer. For this, the allowed source IP range for access to port 22, the SSH port, is set to the local network IP, while for port 80, the HTTP-port, all incoming traffic is allowed.
This leads now to following question: What if no server program is running on a computer and all outgoing traffic should be allowed, does it need a firewall? No, it doesn't. If there is no server listening for incoming connections, the connections will simply fail, no matter, if there's a firewall or not.
So, are any servers running? On most GNU/Linux systems not per default. Nevertheless, if you enable printer- or file sharing, there are, and if those servers have security issues or are configured insecure, your system is vulnerable. An easy way to check for running servers is to use the netstat utility. In order to see which programs are listening for incoming connections, run
sudo netstat -tulp. This will list all (p)rocesses (l)istening for incoming (t)cp and (u)dp connections. On a system that doesn't need a firewall, only programs listening to connections from localhost are in the list. Take my computer as an example:
root@hplj4:/home/andi# netstat -tulp
Aktive Internetverbindungen (Nur Server)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 *:50189 *:* LISTEN 1822/rpc.statd
tcp 0 0 *:sunrpc *:* LISTEN 1780/rpcbind
tcp 0 0 *:ssh *:* LISTEN 3075/sshd
tcp 0 0 localhost:ipp *:* LISTEN 2618/cupsd
tcp 0 0 localhost:smtp *:* LISTEN 2856/exim4
tcp6 0 0 [::]:56398 [::]:* LISTEN 1822/rpc.statd
tcp6 0 0 [::]:sunrpc [::]:* LISTEN 1780/rpcbind
tcp6 0 0 [::]:ssh [::]:* LISTEN 3075/sshd
tcp6 0 0 localhost:ipp [::]:* LISTEN 2618/cupsd
tcp6 0 0 localhost:smtp [::]:* LISTEN 2856/exim4
udp 0 0 *:44539 *:* 2569/avahi-daemon:
udp 0 0 *:sunrpc *:* 1780/rpcbind
udp 0 0 *:ipp *:* 2618/cupsd
udp 0 0 *:683 *:* 1780/rpcbind
udp 0 0 localhost:726 *:* 1822/rpc.statd
udp 0 0 *:mdns *:* 2569/avahi-daemon:
udp 0 0 *:1900 *:* 2978/minissdpd
udp 0 0 *:38900 *:* 1822/rpc.statd
udp6 0 0 [::]:35567 [::]:* 1822/rpc.statd
udp6 0 0 [::]:sunrpc [::]:* 1780/rpcbind
udp6 0 0 [::]:683 [::]:* 1780/rpcbind
udp6 0 0 [::]:mdns [::]:* 2569/avahi-daemon:
udp6 0 0 [::]:54799 [::]:* 2569/avahi-daemon:
As you can see, the printer daemon and the mail server are only listening to connections from localhost (if you add -n to the netstat command, you'll see that they only listen on the loopback interface 127.0.0.1), so they would be fine. The ssh server is set up intentionally to allow connections from anywhere (not too safe, but well, I need it like this). If it were only those services, a firewall would not be necessary. Since however the portmapper (rpcbind) and the UPNP-daemon (avahi-daemon) are listening to any incoming traffic, those either need to be reconfigured, disabled, or protected by a firewall, so that malicious connections from the internet do not get accepted.