For a single web server that only listens on 22/80/443, is a firewall (iptables) really necessary? What exactly is it protecting against if there are only two properly configured services listening on three ports?
This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.
Yes. It provides you with a buffer against incoming attacks and (which most people forget) outgoing malicious traffic, like reverse proxies, spam bots, etc., with the appropriate egress filtering, of course.