On ISR G2 routers, one could configure Inspect statements to allow certain types of return traffic to override an Interface Access-List as long as that traffic was generated from inside the router.  It doesn't seem like I can do that the same way on ...