We never block any ports from our vps, we open all ports, unless there is a complaint on that, and we'll forward the complaint to you, before executing any action (blocking, etc.).
TUN/TAP is disabled by default, but TUN/TAP can be disabled/enable per request
Firewall and/or filter is enabled on a "necessarily" basis