http,https and ftp traffic only from inside to outside??? How

[baig-a]

As default every traffic from inside to outside is allowed and from outside to inside is blocked in PIX. I try to allow only http, https and ftp traffic from inside to outside. After changing I can’t access to internet. I am using PIX 506.

Does my access-list miss some thing?

access-list 120 permit tcp any any eq 80

access-list 120 permit tcp any any eq 443

access-list 120 permit tcp any any eq 21

access-group 120 in interface inside

[craigking]

DNS is currently not allowed through your firewall. Unless you are defining explicit destination IP addresses, your web browser/ftp client cannot resolve the FQDN to an IP address. You need to allow outbound DNS from your internal DNS server or internal hosts to a DNS server(s) on the outside.

[baig-a]

Thanks for reply;

can you please give me some more detail, How can allow DNS for lookup?

[craigking]

You need to also allow tcp/53 and udp/53 going outbound via ACL 120. Add something like the following lines to ACL 120

access-list 120 permit tcp any any eq 53

access-list 120 permit udp any any eq 53

I believe lookups only use udp/53, but I'm not positive.