- Set the default policy to deny everything. (
iptables -P INPUT DENY)
- Allow ICMP
- Add the minimum rulesets required for the services you need.
If you've got ports that are used only by local machines, set allow rules for that combination of port and IP range only.
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
Outbound traffic needs rules as well (permit DNS queries, permit services to respond to connections, etc). Using related / established rules can help with this. Even among otherwise locked-down firewalls, allowing all outbound traffic for simplicity is common.
If you've got the time, an ideal albeit laborious case would be using SELinux to restrict things even further such as by only allowing the DNS resolver libraries to query DNS, etc.
As for "protecting an open port" that comes down to configuring the software listening to it correctly and ensuring any security issues within it are addressed.