Firewall vs No Firewall

I hope someone can clear this up for me. Myself and some colleagues have been discussing the need for a firewall on an external server (the firewall would run on this same server) hosting a few domains running DNS/FTP/Web etc. I think we do, one colleague says that if the server is up to date and configured properly a firewall is not needed. For example he says if we are running mail or web for eg, a firewall wont help attacks tageted at these services. Usually I use iptables to deny everything and open only what is needed, he suggests this is overhead and not neccessary. Is this correct or the done thing? Cee