I am a 'newbie' when it comes to firewalls, but I am trying to launch some machines that will connect to Facebook's Graphs API. I only want these machines to contact Facebook and nothing else. By this I mean, I only want my severs to be able to initiate contact with Facebook servers and get the response back from them, not vice versa (I do not want any Facebook servers to be able to initiate contact with me due to IP spoofing attacks/DDoS concerns).
My initial thought was to allow all outgoing traffic to Facebook server (use a whoami command to get a list of IP addresses), but block ALL incoming internet traffic. If I have this configuration and I send a REST request to Facebook, will the response be blocked even though I initiated the contact? The main question I am trying to answer is: if I block ALL incoming network traffic, does this include responses from a request I initiated?