You can even block everything except certain ports (aka whitelist ports, aka enumerate goodness), as opposed to allowing everything and blocking certain ports (aka blacklisting ports, aka enumerating badness). There's *always* more badness than goodness, and the growth of badness is accelerating. Enumerating badness is a losing game.

(Not that I think Qcumber-some was planning on doing that, but you never know...)

See also the rest of the 6 dumbest ideas in computer security". Not that much of that is inherently related to using Linux as a firewall -- just be sure to design the firewall rules (and the rest of the network topology) accordingly.