I like that Suricata is open source but haven't used it. You can close all your inbound ports and link listeners, e.g. locally resolved DNS and outbound-only https, only for authorized sessions.