You seem more worried about the technical details more than about the rest. Besides the basic golden firewalls rules, as to block ingress and egress networks, the others have to be properly evaluated. As @Stephane posted, there is a need to identify what to protect when dealing with a firewall policy. It is of utmost importance to identify what will influence your stance, and what level of security will be needed and the capability of enforcing it sucessfully: - Your control/operation network Normally most of this network is not supposed to have any access from the normal network and much less from the outside. At most, it can communicate with a proxy to have access to software updates, and with the internal DNS/NTP servers. - Servers providing service to the outside This will be your corporate VPN, DNS, SMTP and proxies servers. They will have direct, somewhat restricted access to the Internet. - Servers being your presence on the Internet WWW servers, or other services provided to the exterior. Only the needed services should be open. - Your layers inside your organisation From instance, in a university, the students quarters have much different requirements from professors networks. - Sensitivity of departments / information HR, financials and operations, for instance, should be insulated from other networks. Some of these departments should also have a more restricted policy about using Internet. - Internal politics Some places just have a politics as providing full access to the Internet, while others for instance, define Internet will have full access outside work hours, while others may define other kind of restrictions. - Your industry For instance, in the Education industry it is expected to have the least restrictions, while in an ISP even less but with bandwidth caps, while in banking being very restrictive either in what gets in or what gets out. However, even often there is a need to not get lost between the distinction [and separation] between the service for customers and the corporate network, where different cultures and rules will apply. - Perceived acquired rights / resistance to change There goes against saying that tradition and acquired rights will play a very strong role into what you can achieve. - User expectations of service vs business needs The balance between security, the needs/wants of users and quality of servce is always a delicate one, and compromises need to be made. For instance, in a very open environment the expectation to use p2p may not be met when it interferes with voIP and HTTP/S services. - Law requirements You may have to keep certain types of logs X time. You might need to cut several protocols, namely bittorrent (several firewalls of big players already come with DPI). - Documentation and monitoring All goes without saying to effectively establish a successful firewalling policy, there is a need to know what is happening inside the network and IF all is documented. Audit the service. A big name player will be more than happy to help if that mens the possibility of scoring a sale. - Support of management Finally, the process as to be fully supported by the upper management, and most of the decisions of what has to be allowed or cut have to be approved by them. - Evolution/Restrictions of technology Restrictions on costs, resources, and requests/needs will influence the decisions on all the above points, and the technology you will use. Mostly in the fast-paced world of technology field, when focusing on the technical side, some of the strategies and decisions you may be using can be or will be shortly outdated. As an example, some vendors are trying to sell me solutions that soon will have impaired functionality due to the widespread proliferation of VPN/encryption for personal use.