Yes, and this is the problem.
?
Oh, yes, there is proven software.
This is not what I'm talking about. I'm not talking about provisions like "buy a box and stick it in, maybe it will help". I'm talking about provisions, where you exactly know what's going on. For example, configuring daemons not to offer to the Internet, configuring inetd/tcpd, configuring the host based packet filter, and configuring a packet filter on a second box, where all traffic has to pass by.
All provisions in this example are addressing the same attack vector, and for TCP based services (with a correct implementation of TCP) all of them manage to secure the attack vector, that services could be accessed via TCP from the Internet which only are meant for being used in the LAN.
Combining them will help with security, if they don't interfere, and you cannot be sure that one of them you're using is not proven correctly implemented.
Yours, VB.