I see you too worried about the technical details, and not about the rest. As @Stephane posted, there is a need to identify what to protect when dealing with a firewall policy. You have to identify what will influence your stance, and what level of security you need and will be able to enforce: - Your control/operation network Normally most of this network is not supposed to have any access from the normal network and much less from the outside. At most, it can communicate with a proxy to have access to software updates, and with the internal DNS servers. - Servers providing service to the outside This will be your corporate DNS, SMTP and proxies. They will have access to the outside. - Servers being your presence on the Internet WWW servers, or other services provided to the exterior. Only the needed services should be open. - Your layers inside your organisation From instance, in a university, the students quarters have much different requirements from professors networks. - The more or less sensitive departments HR, financials and operations, for instance, should be insulated from other networks. Some of these departments should also have a more restricted policy about using Internet. - The internal politics Some places just have a politics as providing full access to the Internet, while others for instance, define Internet will have full access outside work hours, while others may define other kind of restrictions. - Your industry For instance, in the Education industry it is expected to have the least restrictions, while in an ISP even less but with bandwidth caps, while in banking being very restrictive either in what gets in or what gets out. However, even often there is a need to not get lost between the distinction [and separation] between the service for customers and the corporate network, where different cultures and rules will apply. - Perceived acquired rights / resistance to change There goes against saying that tradition and acquired rights will play a very strong role into what you can achieve. - User expectations of service vs business needs The balance between security, the needs/wants of users and quality of servce is always a delicate one, and compromises need to be made. For instance, in a very open environment the expectation to use p2p may not be met when it interferes with voip and http services. - Law requirements You may have to keep certain types of logs X time. You might need to cut several protocols, namely bittorrent (several firewalls of big players already come with DPI). - Documentation and monitoring All goes without saying to effectively establish a successful firewalling policy, there is a need to know what is happening inside the network and IF all is documented. Audit the service. A big name player will be more than happy to help if that nets a sale. - Support of management Finally, the process as to be fully supported by the upper management, and most of the decisions of what has to be allowed or cut have to be approved by them. - Evolution/Restrictions of technology Restrictions on costs, resources, and requests/needs will influence the technology you will use.