firewall necessity

I have a network of three computers. One is a nat server running sybergen sygate. One is a client with full internet access. The other client will be in a room where we don't want the child to be able to use the internet in her room. But we want to leave it easy to connect if we need to update it or anything. So it's set up to be a client, but using sygate's black list, the machine can't access any other IP addresses. It it's sitting like this on an always on connection, is a firewall still recommended to be runnning on that machine?