Linux

Lots of good answers here but I'll toss in my own "figure out what you need" experience from my first firewall funtime. (Disclaimer: I used nftables -- it should be similar to ufw in terms of defaults though).

• Right off the bat, everything unneeded was blocked. I "needed" no configuration, except for maybe...
• Whatever CUPS runs on (when I use it)
• Sometimes I ran python -m http.server -- I unblocked port 8000 for personal use.
• I chose to unblock port 53 (DNS). I wanted to connect to another computer via hostname IIRC (e.g. connecting to raspberry-pi.local. I might be misremembering this though).
• At one point I played with NGINX -- that's port 80 (HTTP) and port 443 (HTTPS).
• SSH was already permitted (port 22 -- you need root access to enable traffic through ports below 1024 anyway so this wasn't an issue for running typical apps)

I didn't use WireShark back then, really. I think I just ran something like

sudo lsof -nP -iTCP -sTCP:LISTEN

which showed me a bunch of port traffic (mostly just harmless language servers).

You don't have to dive to deep into all the "egress" and "ingress" and whatnot unless you're doing something special. Or your software uses a weird port. (LocalSend lol)

You don't need a firewall on the LAN. It is just an annoyance to have to open ports later. Extra bureaucracy without benefits. This isn't Windows, you can can easily control your processes, choose if they bind to the network interface and on which port.

If you really need one take white list approach. Block everything you don't need and only open what you need. Have fun finding out what you need.

I would advise that you ignore a lot if the advise here and do your own research. You probably don't need a local Firewall and if you want to block content use DNS and browser extensions

By default it should be configured to allow all outgoing, and block all incoming. That's perfectly fine for a desktop/laptop and you don't need to mess with it.

You can't really do that much outgoing filtering with a firewall that will be useful, because basically everything operates on port 80/443, and often connects to the same CDNs or datacenter IPs for multiple services.

Instead DNS blocking is a much more effective way to handle it, plus uBlock Origin in your browser.