The most common method of hacking is through an email fishing scam. They get you to execute their code to infect your machine. A firewall will not help this style of an attack. The only way a firewall will help this case is if you filter outbound communications and this is typically never done as it is a major pita to manage, pita is being nice. Why do you say you need a firewall? Typically, most routes use a NAT and the NAT disallows inbound communication unless you set it up to pass specific porta to a specific computer on your internal network. You’re probably good on disallowing in bound communication but I’m guessing here.
Education on what to click on and what not to click on is your best protection against a fishing attack. Know the source domain of any link you click on in an e-mail, if it isn’t from the person the e-mail says, don’t click on it. Better yet just never click on a link in an e-mail, period; If you get a notice that your order has shipped for the you five I-Phones you bought but you never bought a I-Phone, do not click that link in the e-mail.
You can install anti-virus solutions, but I don’t use any because I’m carful on the links I click. Someone here might be able to recommend something, I dislike all because they either consume too many resources or are too intrusive or they are a marking arm of the company to get you to buy/upgrade/consume. I just don’t do it and I’ve been fine.

i use PCmatic

and/or go to Linux, none admin account for internet use

I think jack1776 is right. Use an up-to-date version of your OS (Windows for me), and keep the built-in firewall and virus protection enabled. Then be careful about clicking on anything suspicious.

Anti-virus programs tend to slow down the machine, and sometimes they exhibit virus-like behavior themselves changing things like your brower's default search engines. I think they're more trouble than they're worth.