Hi Carl,
As you say, the established keyword on inbound acls is useful, unless if you want to be explicit about what your users can access outside your network. You may also want to have a deny any any at the bottom with the log keyword if you want the router to log what has been denied. It appears that the acl you are referring to explicitely allows protocols in, regardless whether the connection was initiated from inside your network. This may have security implecations, but it depends on what you are trying to achieve. Without looking at the acl and understanding the requirements it is difficult to say whether there is a problem or not.
Personally I favour reflexive acls which are of stateful nature. In this scenario you configure an inbound and an outbound acl. The outbound allows traffic out which is reflected to the inbound. The inbound acl keeps a state of the connection and allows the return traffic in. Note that for functions like traceroute (responses),traffic initiated by the router and inbound connection to your network from the outside you have to explicitely allowd them in.
I find reflexive acls to need fewer entries and can achieve your objective more efficiently and provide greater security in this kind of scenarios.
HTH
E.
