Q: Do I need to set rules for source and destination ports for outgoing rules on iptables? I'm using puppetlabs firewall module and I'm having troubles setting up iptables for a simple web host.
I'm following this guide and want to set up additional rules.
https://sysadmincasts.com/episodes/18-managing-iptables-with-puppet
For example, I've added rules to allow outgoing traffic with git and mysql ports:
  firewall { '200 allow outgoing mysql':
    chain   => 'OUTPUT',
    state   => ['NEW'],
    proto   => 'tcp',
    dport    => '3306',
    action  => 'accept',
  }

  firewall { '200 allow outgoing git':
    chain => 'OUTPUT',
    state => ['NEW'],
    dport => '9418',
    proto => 'tcp',
    action => 'accept',
  }

and looking in iptables, I can see the following rules:
root@app01:~/geppetto# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            /* 000 accept all icmp */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* 001 accept all to lo interface */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* 003 accept related established rules */ state RELATED,ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80 /* 200 allow incoming http */ state NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22 /* 200 allow openssh */ state NEW
LOG        all  --  0.0.0.0/0            0.0.0.0/0            /* 900 log dropped input chain */ LOG flags 0 level 6 prefix "[IPTABLES INPUT] dropped "
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* 910 deny all other input requests */

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
LOG        all  --  0.0.0.0/0            0.0.0.0/0            /* 900 log dropped forward chain */ LOG flags 0 level 6 prefix "[IPTABLES FORWARD] dropped "
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* 910 deny all other forward requests */

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* 004 accept related established rules */ state RELATED,ESTABLISHED
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 53 /* 200 allow outgoing dns lookups */ state NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 9418 /* 200 allow outgoing git */ state NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80 /* 200 allow outgoing http */ state NEW
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            /* 200 allow outgoing icmp type 8 (ping) */ icmptype 8
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 3306 /* 200 allow outgoing mysql */ state NEW
LOG        all  --  0.0.0.0/0            0.0.0.0/0            /* 900 log dropped output chain */ LOG flags 0 level 6 prefix "[IPTABLES OUTPUT] dropped "
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* 910 deny all other output requests */

However, I can't access anything with git from the machine. Running git fetch origin just times out. Do I have to set up some rules for the outgoing source port as well? Thanks in advance!

A: There are several protocols that Git can use, which are documented here - the most common of which is SSH, which is used on GitHub (both public and Enterprise flavours) as well as Gitosis and Gitolite.
To use Git over SSH, you will need to open port 22 outbound, and to use the much rarer Git protocol, you'll need to open port 9418, which you already have, so the chances are that you are actually using an SSH Git URL.
Example: git@github.com:craigwatson/puppet-vmwaretools.git
