cisco firewall access rules

Your question is very vague especially when we cannot see your configuration that you are referring too. Please post a "sanitized copy" of your config and tell us what your overall intent is for us to better assist you in completing this task. Thanks.

Its a new firewall with the default settings on the inside interface, which is "ip any any". There is no problem the way it is right now, but having "ip any any" pretty much opens it up to everything. I'm just thinking of general ports to open for common access to a few clients behind the firewall - 80/443, 53, other than that any suggestions as what to add? The reason is I do not want the "ip any any" and want to lock it down to only what is needed. But if I disable the any any I may not be able to get back in to make changes needed. Thanks.

The default doesn't allow traffic inbound other than responses to traffic generated from the inside.

So no outside initiated traffic can get inside.

But as previously stated, it's hard to say without seeing the config.

yes, but those responses generated from the inside need to have an acl for them to go out no?

There won't be a response to outside initiated traffic because the inside host will never receive it.

Thanks for the explanation.