I'm learning about firewalls and access-lists, and I'm trying to decide what sort of access list I should have on the DMZ, particularly regarding outbound traffic. There's certain outbound traffic that I don't want to allow - obviously, SMTP should only be allowed to originate from the mail server and so on. However, I've heard that outbound filtering often causes problems if you're too strict, because there's a lot of legitimate resources that can be requested and it's hard to know all of them.
My question is, once I have an ACL that allows things like SMTP only from the mail server and so on, what rules should I put at the end of the ACL to not break everything? Saying
access-list tcp permit any any access-list udp permit any any access-list ip permit any any
seems a little insecure. Are there ranges of ports that I can safely close off? Or is a permit any any pretty much my only option?