For a while now I am using CSF as main firewall with LFD, and OSSEC as main IDS. (I like OSSEC over the overreacting builtin IDS of CSF).
I tested it for small DoS attacks such a slowloris variants and synfloods. Works fine. Apache is running with mod_security and mod_evasive. Works fine.
In the backend audit is watching my password files for changes and I have Clam AV running as main AV together with LMD (linux malware detect) running at nighttime. LSM is is monitoring port activity of all daemons.
the only internet-accessible services that are running on the server are a TOR-relay (non exit), Apache and SSHD.
Question: Why should I filter egressing traffic from my server with CSF?
I cannot find any advantages other than managing which traffic is allowed to exit my server. Since I have no other users using my server and hackers/crackers could simply use any of the open exiting ports 22,80,443,9001,9030,9595 to exit my server; why filter it?
meta: Centos 64b, LMD, Audit, CSF, LFD, OSSEC HIDS, ClamAV, LSM
P.S: I forgot to mention why I am posing this question: Clamd wants to update regularly and it seems that I can't set the outgoing port.