Well the windows firewall has its limitations XP no outbound protection, Vista outbound protection disabled by default, not very user friendly if enabled. Vista Firewall Control, check out this topic for some user friendly help for the Vista Firewall, Outbound protection,
http://forum.avast.com/index.php?topic=30234.0Router, hardware firewall, unless it specifically says it providers outbound protection, then it doesn't.
Any malware that manages to get past your defences will have free reign to connect to the internet to either download more of the same, pass your personal data (sensitive or otherwise, user names, passwords, keylogger retrieved data, etc.) or open a backdoor to your computer, so outbound protection is essential.