Does port 8333 need to be opened as TCP_OUT or TCP_IN?

Question

Does port 8333 need to be listed in TCP_OUT in a firewall or in TCP_IN as well?

Answer 1

Port 8333 is only relevant for inbound connections. Opening it allows other nodes to start talking with your node.

That said, a Bitcoin node can fully participate in the network even if you don't allow inbound connections (to port 8333). It'll use outgoing connections, which start from random higher unprivileged ports and connect to port 8333 of another node. If you can allow incoming connections that's good for the health of the Bitcoin network, otherwise outbound connections are functionally equivalent.

Bitcoin Core can also offer a JSON-RPC interface on port 8332, so if you need that, act accordingly.