Note that if an external source attempts to establish a
TCP connection with an internal host, the connection will be blocked, even if the
source or destination port is 80. The second two rules together allow DNS packets
to enter and leave the organization’s network. In summary, this rather restrictive
access control list blocks all traffic except Web traffic initiated from within the
organization and DNS traffic. [CERT Filtering 2012] provides a list of recommended
port/protocol packet filterings to avoid a number of well-known security
holes in existing network applications.