I've setup a port knocking scheme to protect port 22 using iptable rules. On top of that I've setup some "honey pot" rules to disable port knocking for the client for several minutes if they hit common ports that are not used (port 21 for example) or ports around the knocking sequence. This seems to work well (I believe it's a better option than changing the port to something obscure). For SSHD password logins are disabled anyway - an encrypted private/public key combo is required.
On this page there is a "drip pan" scheme that if unused ports are hit the client cannot communicate with anything (even open ports) for 60 seconds. My biggest concern is "--hitcount 3" seems to be triggered by any simple request to a single port.
So my question is, what do you think about this kind of setup? Is the "drip pan" too much on a web server, or just right? Other than keeping a drop in-out policy and only opening what is needed, do you guys have any other firewall security advice?
Edit: I'm using CentOS 5.7. We're assuming as "secure as possible within reason". A server would have to pass PCI/SAS compliances (and other similar standards). Focus would be the firewall, not necessarily vulnerabilities with individual services that could come be discovered (that's another topic). Anything that I'm missing related to the firewall or anything on the outside. Want to make it as difficult as possible for an attacker to gain access.