Firewall: is it better and more practical to have it "off"?

No. It's just the default internal IP address virtually all small (home or small business) routers assign to themselves.

If you look in the System Preferences > Network area, you'll see your MacBook has been assigned something like 192.168.0.5 . That's DHCP in action, which is an automated protocol that allows the user to simplify networking. You don't have to manually assign all of the various settings for each network capable device. The router does it for you. Each device will have it's own distinct IP address. Your Blu-ray player may be 192.168.0.3. Your iPad 192.168.0.12. DHCP between the device and the router negotiate for an address that isn't already in use, and the router than gives that device an address of its own.

You won't know if the firewall of your router is enabled until you put 192.168.0.1 into your browser's search field and connect to it. Put in the admin name and password for your router when prompted. Once in to the router's web pages, you can look to see what firewall options there are, and what is, or isn't enabled.

How would I know if I am on " a hardware firewall enabled DSL or cable router"?

The ISP itself doesn't have a firewall. It's the router you use with the service is where it would be. Virtually all newer routers (within at least the past 5 years) come with a firewall that is enabled by default.

Where to look depends on your service. Type this in your browser:

192.168.0.1

Virtually all home routers use this as the default self-assigned IP address. You'll need to enter the admin and password fields. Usually, this information is on a sticker of the router itself. Once past the login, you can look around.

With CenturyLink, under the main Modem Status heading, I can click on Firewall Status in the left column of choices. Of various possible firewall options, NAT is already on.

If you're already on the user side a hardware firewall enabled DSL or cable router, then there's no need to have the OS firewall on. There's nothing for it to do.

If you take your laptop out though, then you definitely want it on when using Wi-Fi services at coffee shops, or wherever.

No. WPA/WPA2 is the security setting for the wireless access on your Mac. You'll find the same type of setting in the router's web pages.

A noticed after initially posting I typed the IP address wrong. I corrected it above. It's 168, not 169.

Lastly, Kurt: this 192.168.0.1 number on the modem, does that

then indicate that it actually has firewall protection?

No. It's just the standard IP address for most routers.