Yep, everything that isn't used is closed, only 80 and 443 are the services you'd expect, port 22 is an endlessh tarpit, and the real ssh port is open on a very high unassigned port to make it less likely to be found unless completely port-scanned. This may be overkill, but it was fun to set up.