I am currently using a paid security system that includes a firewall. It is rather expensive and I know you are a believer in iThemes. I don't think they include a firewall. Is a firewall necessary with iThemes?
No, it doesn't appear that it has web application firewall features. Here is the statement from their website:
For a WordPress firewall solution, we strongly recommend using Sucuri’s Website Firewall (WAF) along with the iThemes Security plugin. While iThemes Security hardens your WordPress application, Sucuri’s Website firewall works on the server level to provide a deeper layer of security.