Since you're using UFW, it's a greatly simplified firewall interface compared to, say, using
iptables directly. Consequently, it does some "magic" for you:
- Blocks all incoming traffic by default.
- Allows all outbound traffic by default.
- Allows some incoming traffic (packets that are related to or part of an established connection)
Then, the rules you create are incoming rules only, but the outbound part will be allowed because all outbound is allowed by default. So your rules are to allowing incoming traffic.
I wonder if I shouldn't go 1:1 by means of tcp:udp.
There's no reason to do that. HTTP, SMTP, HTTPS never go over UDP, so why open holes in the firewall you don't need? Of the ports you listed, DNS is the only one that might use UDP. (Note that you only need to allow 53/udp) if you're hosting DNS, not to access an upstream DNS server. (And if you're hosting DNS, you should allow 53/tcp as well.)
I wonder if I should distinguish incoming/outgoing for tcp/up or both.
As noted above, UFW does incoming rules by default, so you are distinguishing, it's just not obvious because it's part of the "uncomplicated" nature of UFW.
I assume you're running something on port 9000 that lead you to open that port, but I don't know what it would be -- it's not needed for nginx, postfix, or SSH by default.