I'm running Apache on a server with stateful firewall where new IPv4/IPv6 ingress connections are allowed only to TCP ports 80 and 443. SSH is allowed from few trusted hosts and only certain ICMP/ICMPv6 messages and UDP destination ports 33434 - 33534(traceroute in UDP mode) are allowed from everywhere. Outgoing traffic is not firewalled. Is there a point of running IDS(for example Snort) in such environment on the server? If yes, then what does it mitigate or what additional visibility does it provide?
If your accessible web ports are hosting an application that is pwned and has a privilege escalation exploit. You won't know. Your firewall did it's job, but your system (and network) is pwned.
If your firewall doesn't restart on system reboot the safety net of an IDS of some kind may alert you to some misbehaving.
If you don't know what 0-day exists, you may never know when they are used on your systems without the visibility.
If it's your hobby blog, not necessary. If it's an entry point into your DMZ and corporate network - maybe a bit more useful.