Luis,
I wouldn't use config maker. It's not good for these types of configs. Actually, it's not really good for anything.
Basically, if you've got the config set up properly, your inside hosts should be able to send DNS queries (destination port is UDP/53) and the responses to those queries will be allowed back in. You do need not specify what type of traffic can go out. You are basically concerned with "inspecting" the outgoing traffic as it passes through the outside interface. Once the traffic is inspected and it leaves the router, it dynamically adds an entry to an extended access-list that you applied to the outside interface to control inbound traffic.
Your ip inspect statement could have the following:
# config t
#(config) ip inspect name myfw udp
#(config) ip inspect name myfw tcp
These two protocol are often all you will need to tell the router to inspect. The udp statement will include UDP/53 DNS queries to work correctly, allowing you to browse the internet with names.
The only access-list statements you need would look like this:
#(config) access-list 101 deny tcp any any
#(config) access-list 101 deny udp any any
Tie it together with this on the outside interface:
#(config) int s0
#(config-int) ip access-group 101 in
#(config-int) ip inspect myfw out
This is the most basic IOS fw config.
good luck. for more info and alternate places to inspect and apply the access-list, see:
http://www.cisco.com/warp/public/110/32.html
mike kantowski
ccnp
