I often hear of the benefits of a firewall blocking certain ports to "increase security". At the same time, there are some ports that are usually left open (e.g. port 80).
On firewalls you will almost always block all incoming traffic by default except for traffic destined for a specific service.
If you don't have a strong requirement for security you will just permit outgoing traffic on any port.
If you need to be a bit more secure you will block outgoing traffic to commonly abused ports. For example you would block outgoing SMTP, except from your mailserver to prevent your internal systems from becoming a source of SPAM.
As you grow even more paranoid, you will not permit any direct outbound access, and you will force all traffic through application level firewalls that are able to dig deeper into the payload then what you get with just a basic packet filter. For HTTP traffic you would use a HTTP proxy like Squid. For DNS, you might run your local DNS caching server instead of permitting direct access to external DNS servers. The list goes on. Almost every common server has a application level proxy of some sort. This means you don't need to open 'port 80' irrespective of whatever protocol some client chooses to use on port 80. Instead you permit HTTP/HTTPS traffic from your clients to connect to port 80/443, and you prohibit everything else.
Also, understand that your network has to fulfill its purpose. This always means that there will be some sort of compromise between extremely paranoid security, and making things actually work for your users.