stateful or stateless?

[lamixer]

I think I know the answer to this, but not sure. If I want to create an allow rule that overrides a general block all configuration, do I need to do outbound only or both directions? For example, to allow the machine to make port 443 TCP connections to domain google.com, is outbound sufficient? And then the firewall knows that the returing traffic from that request should pass back in (stateful)? I did try each of those settings and at some point thought outbound was enough, but then I later thought it was not continuing to work so I used 'both'. Thanks, sorry if a stupid question!

[starkjohann]

Little Snitch for Linux tries to track connections (stateful in this respect). You can get a dump of the current internal state as debug logs on SIGQUIT (signal 3). This works well for TCP and should work well for UDP. However, UDP has no such thing as a close of a connection, unless the process closes the socket (UDP is datagram based, there is no real connection). We therefore use heuristics to find higher level protocol connections based on UDP (QUIC, streaming protocols). And that's basically timing. If no data is exchanged for several minutes, we interpret the next packet as a new connection. If it's a reply, we report it as incoming connection.

But simply check what the UI shows: If it shows a connection as outgoing, an outgoing rule is sufficient. If it's also shown under incoming, you may need a bidirectional rule.