Lots of good answers here but I'll toss in my own "figure out what you need" experience from my first firewall funtime. (Disclaimer: I used nftables -- it should be similar to ufw in terms of defaults though).
- Right off the bat, everything unneeded was blocked. I "needed" no configuration, except for maybe...
- Whatever CUPS runs on (when I use it)
- Sometimes I ran
python -m http.server-- I unblocked port 8000 for personal use. - I chose to unblock port 53 (DNS). I wanted to connect to another computer via hostname IIRC (e.g. connecting to raspberry-pi.local. I might be misremembering this though).
- At one point I played with NGINX -- that's port 80 (HTTP) and port 443 (HTTPS).
- SSH was already permitted (port 22 -- you need root access to enable traffic through ports below 1024 anyway so this wasn't an issue for running typical apps)
I didn't use WireShark back then, really. I think I just ran something like
sudo lsof -nP -iTCP -sTCP:LISTEN
which showed me a bunch of port traffic (mostly just harmless language servers).
You don't have to dive to deep into all the "egress" and "ingress" and whatnot unless you're doing something special. Or your software uses a weird port. (LocalSend lol)