# Ensure ufw outbound connections are configured (Manual)

Necessity: Configuring the default outbound connection policy is a critical security measure known as egress filtering. While many firewalls focus on blocking unwanted incoming traffic, controlling outgoing traffic prevents compromised systems from exfiltrating sensitive data, communicating with command-and-control (C2) servers, or participating in botnets. A misconfiguration that allows all outbound traffic by default exposes the network to significant risks if an internal host is breached.

Auditing and Remediation: The audit script verifies the current default setting for outbound connections managed by UFW (Uncomplicated Firewall). The remediation script modifies this global rule, changing the firewall's default behavior for any outgoing traffic that does not match a more specific rule.

Recommended State Rationale:
- Basic: ['allow'] - This is the default configuration for UFW and many other systems. It prioritizes functionality over security, as it does not restrict any outbound connections, making it easier to set up services but providing no protection against data exfiltration.
- Moderate: ['deny'] - This state implements a policy of least privilege. By default, all outbound connections are blocked. Administrators must then create explicit 'allow' rules for necessary services (e.g., DNS, package updates, application traffic). This significantly enhances security by preventing unauthorized outbound communication.
- Strict: ['deny'] - The strictest and most secure posture is to deny all outbound connections by default. There is no state more secure than 'deny' for a default policy. This approach is identical to the moderate recommendation and is considered a best practice in secure environments, aligning with guidelines from benchmarks like CIS.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['allow']` |
| **Moderate** | `['deny']` |
| **Strict** | `['deny']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks the UFW default outbound policy. The script should parse the output of 'ufw status verbose' to find the default outgoing policy and return only the value (e.g., 'allow', 'deny', 'reject') without any additional text or labels.

## Remediation Script Working

bash script that accepts a single positional argument representing the desired outbound policy (e.g., 'allow', 'deny', 'reject'). The script must use this argument to set the UFW default outbound policy using the 'ufw default' command. The script must return 'true' if the command succeeds and 'false' if it fails.

