Since a password is required to be a superuser (to install and modify programs), what are the risks to not use a firewall under Ubuntu ? More particularly if I am using a NAT router ?
It depends. Most people use a router between their desktop and the internet and by default there are no sigificant open ports, so in the vast majority of user cases a firewall adds very litte, if anything.
It can help if you inadvertantly install a server, such as VNC or SSH.
A better question is what do you want to use a firewall for ?
If you want a graphical tool for your firewall, use gufw
It sounds like the question is about a host-based firewall on an Ubuntu PC.
IF the machine never leaves the NAT-based network (ie, it is not a laptop that you take to coffee shops and use on free wifi networks),
AND there are no ports open on your router that could be mapped to your Ubuntu machine,
AND your router doesn't have any features which helpfully open ports for you based on things that happen on your network (UPnP)
AND you will never have any other devices on your local network that might be compromised and attack your Ubuntu box,
THEN your system is probably secure without a host-based firewall.
However, if some of these things aren't true, or might become untrue in the future, a host-based firewall is a really good idea. Given the potential benefits and the limited drawbacks, why not enable it?
Using a NAT, if you have no port forwarding to your machine, it is not accessible from the internet unless you explicitly open a connection to it (with vnc or teamviewer for example) so I think there is no problem not using a firewall on it. The unique worry could come from internal (LAN) access but usually not the case on home lan.
The function of a firewall is to block access to services that otherwise would allow it. Ubuntu has no listening services by default, so there is nothing to block. Further, since you are behind a NAT router, you already effectively have a firewall.
I think one of the most used firewall feature is to prevent "cracked" programs to check the license on internet. If the "cracked" application doesn't need to be update or doesn't use "online" features, you can prevent it to accessing the internet by setting up a specific firewall rule. Sad but true.
In general cases, being either public computers or computers without a secure connection such as those more or less hijacking internet connections from other users in adjacent ports (i.e. houses/apartments next door), then that alone - I think - would give an example of how a firewall (being discretion) could be the better part of valor, so to speak. Plus, they keep those around you from digging into your information whether it be personal or even just something goofy you might be screwing around with. The point is privacy.
When I say general, again, I mean places like public venues. Libraries where all and sundry before you use portable carriers such as USB anything, really, discs - even if you were to do something possibly rash such as take your own external hard drive elsewhere and plug it in, there's no guarantee that the subsequent port is protected by virus or spyware blockers and all of that could latch on and carry itself right back to your original home laptop/desktop, thus making itself at home.
So while there might not be a vehement need in a lot of cases for a firewall to protect against a lot of things, they certainly come in handy against certain - if isolated - cases.
In between, I found some interesting considerations about firewall.
The article explains the notion of "service listening", "open port" and "NAT router" which can be misunderstood to conclude that : - better with than without (even if you drive a tank, put your seatbelt on) and - think twice before doing something affecting the system (educational considerations)