Note: This is known to work for a machine acting as masquerading firewall for an entire network.

I wanted to block connections to certain outbound ports. After some trial and errors I found something that works

Add the following to /etc/ufw/before.rules:

-A ufw-before-forward -s <SOURCE IP> ! -d <LOCAL NET>/24 -p tcp -m tcp --dport <DEST PORT> -j DROP

it’s as simple as that.

Remember to reload all the rules:

$ sudo ufw reload