They are if you use them properly. Block ALL access to every port that isn't absolutely critical. Where possible, shove critical-needs machines that must have net connections outside the firewall, and lock down at the machine level. (i.e., web servers should be outside the firewall - but 22 and 80 should be the only accessable ports, and Apache should be kept current.) Firewalls are EXTREMELY effective when you use them as they were intended to be used, rather than the "but I can't play Quake" way most users would have us do it.

- Ozymandias