Alright, I've seen this question come up a dozen times, usually right before someone has a bad day. Let's set the record straight: there is no "best practice" that involves an outbound "any/any" rule. If you're asking this, you're thinking about your firewall like it's a simple on/off switch for the internet, and that's a dangerous way to operate.
A firewall, even a SonicWall, is a stateful inspection device. The moment you create a rule from LAN > WAN with Source Any, Destination Any, Service Any, and Action Allow, you've effectively neutered its primary function for outbound traffic. You're saying, "Every single device on my internal network can talk to any IP address on the internet, on any port, for any protocol." This is how crypto-mining scripts, botnet callbacks, and data exfiltration attempts blend into normal traffic.
What you *should* be doing is working with a default-deny posture, even outbound. Start by blocking everything, then build explicit allow rules. I know, I know, it's more work. This is where the "operations" part of DevOps comes in. You need to understand what your workloads require.
Here's a basic, sane starting point for an outbound policy on a typical corporate LAN. You'd build these rules in order on your SonicWall (likely under `Firewall > Access Rules` for the LAN > WAN zone).
* Allow LAN Subnet to Any, Service `HTTP, HTTPS, DNS`. This covers web browsing and basic resolution.
* Allow LAN Subnet to Any, Service `SMTP, SMTPS`. If you have an internal mail server.
* Allow Specific Servers to Specific Cloud Provider IPs, Service `TCP/443`. For your backup server or CI/CD runner.
* A rule to allow NTP from your internal time sources.
* A final explicit `Deny` rule for LAN > WAN, Source Any, Destination Any, Service Any.
For servers or specific app environments, you lock it down tighter. Ansible makes this manageable at scale. Don't just think "servers," think "service accounts" and "applications."
Your monitoring stack (you *are* monitoring your firewall logs, right?) will show you what's being blocked. You then analyze, justify, and create a specific rule for that needed traffic. This is the process. It's not glamorous, but it's what works in production to contain the blast radius when something gets compromised.
The trendy thing is "zero trust" and micro-segmentation. The old-school, practical first step towards that is simply stopping the wild west "any/any" outbound rule. Control the egress. Your future self, investigating an incident, will thank you.