This seems like a stupid question, but how do I set up a firewall rule
to allow HTTPS on a basic packet filter firewall?
There are generally no stupid questions and this is a fairly legitimate question to ask, so no need to apologise. Let me try and explain this as plainly as possible, without necessarily sacrificing clarity and correctness.
Note: While you ask for a solution I will provide you with some background as to why you may not want to do what you're attempting. If you fully understand the consequences of your question and all that it entails I suspect my answer may not be one that you seek. Should you however want to understand why the configuration is not all that great, by all means, continue to read.
It has already been explained that what you see are the so called ephemeral ports. These are dynamically allocated by the network stack in your operating system. Why is my operating system using these high-numbered ports instead of 443 you may ask?
There are several reasons, allow me to highlight a few that may help you in understanding why this isn't necessarily a problem.
- Browsing (network) efficiency
- Security (permissions)
If you were to enforce your operating system (and client software) to use only port 443 you'd significantly reduce the opportunity for the OS and browser to use network parallelism, something that is utilised to increase the speed of page-loading. You see, there are a number of limitations in how HTTP works as a protocol such as a single requests at a time. Using multiple connections to download content is one way to help overcome this limitation; as is HTTP-pipelining.
The second reason mentioned above is about security. Most operating systems consider ports below 1024 (0-1023) privileged. In order for a user-land application to bind (use) one of these ports additional privileges are required by the application (such as running with administrative privileges, or using a particular capability in Linux, see this.).
What you've identified isn't usually considered an issue (for HTTP) with modern operating systems as their respective network stacks will know which packets are related to which packets.
If you're still concerned and simply not convinced by either of the provided answers for your question you could do attempt the following. Investigate if your browser can be limited to a certain range of ephemeral ports such as 51000-51100. Then create a rule to allow only these ports to be used as src-port in combination with dst-port 443.
However, note that restricting your operating system and client software to these ports may have unforeseen consequences as there may be other applications using these ephemeral ports you just assigned.
TL;DR - Don't worry about the ephemeral ports used when browsing, trust that the operating system handles associated and related packets correctly. Enforce dst-port and be happy with that. :-)