It largely depends on how good the firewall in front of it is. If your router or network firewall is fairly robust you could do without, but it won't do any harm.
Ufw would be fairly simple, disallowing everything that doesn't come from the internal network and via port 43.