Outgoing firewall rules are hard, I mean really hard. Incoming are easy because as the (application|db|sys)?admin you should have a pretty good idea of who (audience) needs to talk to what (service). With outgoing rules, however, you need to,
- Take a complete inventory of services that will be asking for data
- For each service determine which port(s) it will be going out on
- Find all possible hosts that your system will be contacting
Using 2 and 3 you can construct your rules. The reason this gets hard is really because of 3. Let's take OS patches as an example.
By default your package manager is almost certainly pointing at a mirror list. So you have two options,
- Determine the IP address of every host in the mirror list and write the permit ACLs for each
- Change your package manager to point directly at one of the hosts in the mirror list and write the permit ACL for that single host
Now do this for everything. That is why it gets complicated, and a big reason why most people don't bother. In some cases you have are required to limit outbound rules, think PCI-DSS or HIPAA depending on your auditor. However, most of the time the resource you're trying to protect isn't actually valuable enough to warrant the extra work.
That being said, it is also a fantastic exercise to go through. You will have a much stronger understanding of your system, and will have a significantly smaller attack profile to monitor.
All that being said, the wget application will most of the time be working against HTTP or HTTPS, that is TCP ports 80 or 443. It is possible to host web services on arbitrary ports so you'll need to make sure to allow the appropriate ports for whatever webserver you are pulling down data from. Also make sure to allow ESTABLISHED and RELATED connections, so that the responses will be allowed through.