I recently set up the ufw firewall on a Linux machine so that outgoing connections are allowed, incoming connections are denied, and denied connections are logged. This seems to work fine for most cases, but I see many denied connections that are incoming on port 443 (many with IPs associated with Facebook).
I can open that port to incoming connections, but first wanted to ask what these could be. Shouldn't HTTPS requests be initiated by me and be treated as outbound, not inbound connections? Is it typical to open incoming port 443 on consumer firewalls?
An example log entry:
[UFW BLOCK] IN=wlan0 OUT= MAC=XXX SRC=126.96.36.199 DST=192.168.1.32 LEN=473 TOS=0x00 PREC=0x00 TTL=83 ID=59450 DF PROTO=TCP SPT=443 DPT=58530 WINDOW=33 RES=0x00 ACK PSH URGP=0