When configuring a server firewall, most administrators focus entirely on inbound traffic—blocking unauthorized IP addresses and closing unused ports to keep attackers out. However, if you leave outbound traffic completely unrestricted, you are leaving a massive vulnerability open. By default, tools like UFW (Uncomplicated Firewall) block all incoming connections but allow the server to initiate any outgoing connection it wants.
If a malicious actor manages to exploit a vulnerability in your web application (such as a remote code execution flaw in a PHP script or Node.js package), their first objective is usually to establish a "reverse shell." Instead of trying to break through your inbound firewall, the malware simply commands your server to initiate an outbound connection back to the attacker's machine. By strictly controlling egress (outbound) traffic, you can trap the malware, preventing it from "calling home," downloading additional payloads, or exfiltrating your database.
The Danger of Unrestricted Egress
Allowing your VPS to communicate freely with any server on the internet introduces several severe risks:
-
Reverse Shells: An attacker bypasses your inbound firewall by having your server connect outwards to their command-and-control (C2) server.
-
Data Exfiltration: If your database is compromised, the attacker can silently push gigabytes of sensitive user data directly to their own external storage buckets.
-
Botnet Participation: A compromised server with open egress can be used to launch outbound DDoS attacks against other networks, which will quickly lead to your hosting provider terminating your account.
Whitelisting Essential Outbound Ports
Before you deny outbound traffic, you must explicitly whitelist the specific services your server actually needs to function. If you blindly block all outgoing traffic, your server will immediately lose the ability to resolve domain names, download security patches, or sync its internal clock.
Connect to your server via SSH and execute the following UFW rules to allow critical outbound communications:
-
DNS Resolution: Your server must be able to resolve domain names to IP addresses.
sudo ufw allow out 53/udpsudo ufw allow out 53/tcp -
HTTP and HTTPS: Necessary for your server to download software updates via
apt, fetch Let's Encrypt SSL certificates, or make external API calls.sudo ufw allow out 80/tcpsudo ufw allow out 443/tcp -
NTP (Network Time Protocol): Essential for keeping your server's internal clock accurate, which is strictly required for cryptographic functions and Two-Factor Authentication.
sudo ufw allow out 123/udp
(Note: If your server acts as an SMTP mail server or needs to connect to an external database, you must also allow outbound traffic on those specific ports, such as 587 for secure mail submission or 5432 for remote PostgreSQL).
Changing the Default Egress Policy
Once you have meticulously whitelisted every port your applications and operating system require to function normally, you can drop the hammer on everything else.
-
Change the default UFW policy to silently drop all outbound connections that do not match your whitelist:
sudo ufw default deny outgoing -
Ensure your default inbound policy is still set securely:
sudo ufw default deny incoming -
Reload the firewall to apply the new rules immediately:
sudo ufw reload
Auditing Blocked Outbound Attempts
After locking down your egress traffic, you should monitor your system logs to ensure you haven't accidentally broken a legitimate background service, and to watch for malware desperately trying to call home.
-
Enable UFW logging if you haven't already:
sudo ufw logging on -
Search your kernel logs for outbound connection attempts that were actively blocked by your new strict policy:
sudo grep "\[UFW BLOCK\]" /var/log/kern.log | grep "OUT=" -
If you see a legitimate service (like a backup script trying to reach an off-site SSH server on port 22) being blocked, you can easily add a targeted exception:
sudo ufw allow out to any port 22
