I'm concerned that in my network some background applications / virus can use my internet connection as malicious backdoor, and then I'm in trouble (i.e. authorities can think that one of my pc has done something illegitimate / illegal) so I've taken the decision to CLOSE all the outgoing connection to the network, except navigation and some other services (skype, email, ecc); but how can I perform this being secure that a virus / backdoor will utilize the ports opened to obtain the above services (ie 80, 483, 25, 143, 587 ecc.)? Should this be made at application level (what for example if a virus simulate to be "outlook.exe" and send an email to the regular port I opened?) What's the best policy for this environment? I would like to setup it in my firewall, and leaving EVERYTHING but the web and other services out. It seems to be a problem bigger than I can handle. Thank you.
What you want to achieve is impossible using a simple firewall that just blocks ports, exactly for the reasons you stated. A smart malicious program installed on your machine will use ports you don't block, e.g. 80, 443 or maybe the various ports used for smtp, although these aren't as reliable as 80 and 443. It might also use udp and masquerade as DNS lookups.
To catch such traffic, you'd need a firewall that inspects traffic (deep packet inspection). Or you could use an intrusion detection system; these often work by learning what constitutes "normal" traffic and then alerting you when traffic that gows outside these bounds is detected. This might be as simple as alerting you when a lot of connections to different machines are opened, or detect moee complicated patterns.
If you're a private person trying to secure a home network, I'd say the effort isn't worth the gains. It's different for a company network.
Blocking destination ports you don't need on outgoing traffic is a good first step, though, and doesn't have negative consequences. You can also block specific host names or IP adresses to block specific programs from phoning home.
An alternative to doing this at a network level is to use an application whitelisting program. This approach is gradually becoming recognized as one of the few feasible ways of dealing with the flood of malware out there. In this approach, only known good programs are allowed to execute - there is no guessing, signatures, heuristics or anything else, if it isn't on the allowed list, it doesn't run.
It definitely impacts usability, though - it is generally considered suitable for computers that have defined usage patterns. It is more difficult where general purpose computers are concerned, where you are expecting to install programs often (since the white list is only good if you are very, very careful what goes on it).
An option, at least.