So I denied everything except DNS, HTTPS and HTTP in the gufw firewall.
ufw status verbose looks good with no DENY for port 53 and only allows at the bottom of it. I even executed
sudo ufw allow 53/udp and also tried setting the DNS nameserver to 22.214.171.124. Still it doesn't work: apt-get update gives me "Temporary failure resolving 'security.debian.org'". Pings don't work either.
In /var/log/syslog it also says:
WARNING: Can't read main.cvd header from db.local.clamav.net (IP: )
WARNING: Can't query current.cvd.clamav.net
WARNING: Invalid DNS reply. Falling back to HTTP mode.
Reading CVD header (main.cvd): ERROR: Can't get information about database.clamav.net: Temporary failure in name resolution.
Activating service name='org.kde.powerdevil.backlighthelper' (using servicehelper)
avahi-daemon is set to DENY in case that matters.
Also a ClamAV scan found the same as listed in my question here
It worked earlier using iptables which basically had the same rules for DNS.
I'm running a freshly installed Debian 9.1 with KDE.
Any ideas what might be causing this? How can I get it working?