I just got a full node up and running, following the guide on here http://iota.partners/. I have a firewall on, so all ports are blocked except for UDP 14600 and TCP 15600.
In my iota.ini file I have this:
REMOTE_LIMIT_API="removeNeighbors, addNeighbors, interruptAttachingToTangle, attachToTangle, getNeighbors"
If I understand correctly, this makes all the "dangerous" API calls only available from localhost.
Would it then be safe to open port 14265 to the public?