NixOS default network protections

Help
1

I know that Nixos by default blocks listening all ports and it’s an unwritten policy that no module should open ports.
What other security network protections Nixos put on by default?

2

But don’t the SSH and httpd modules do exactly that? Once enabled, they open the port?

3

Only ssh opens ports by default.

4

Ah, okay, then I misunderstood something. I don’t have anything enabled except for SSH so far.

5

Many modules have an openFirewall option. Maybe you were thinking about that?

6

Mostly I wanted to know if there were any other gotchas in the default network configuration.