How to implement a DMZ and allow outbound traffic to any IP

Question

Consider the this simplified scenario with a LAN and a DMZ. 
 
 The LAN must be able to access the DMZ 
 The DMZ must be able to access anything on the internet 
 The DMZ must not be able to access the LAN (except for whatever well crafted rules) 
 
 My LAN and DMZ have masquerade rules setup so internet requests go out to the WAN. I'm tripped up on the rules allowing the DMZ to access any IP, but not in the LAN. 
 
 A rule allowing requests from the LAN to the DMZ works 
 A rule allowing the DMZ to access to any IP allows it access to not only the Internet but the LAN! 
 Creating either an "inbound" rule on the LAN blocking traffic from the DMZ, or vice versa an "outbound" rule disallowing access from the DMZ to the LAN blocks related or established traffic: so when the LAN makes a TCP request to the DMZ, the DMZ's SYN/ACK gets dropped. 
 
 I come from Linux knowing iptables quite well where defining the ingress and egress interfaces on a rule would fix this or where I could craft a rule allowing established or related traffic and this wouldn't be a problem. I feel like there's a trick I'm missing, but I've been looking all over and can't see one other than to craft explicit rules for every outbound connection. What's your advice?

PeterRenchen · Accepted Answer

Hi, 
 Src: DMZ Network, Services: Any, Destination: Internetv4 Object. 
 Don't use Webproxy on DMZ Net. 
 VG

Emile Belcourt · Answer

Just to add to Peters comment on the "Internet IPv4" object. 
 Basically it means anything that is a target that is not a local interface subnet or part of the routing table and is destined for the 0.0.0.0/0 default route. 
 Which in 90% of configurations is the Internet. 
 Failing that, you can make a private address range block target for DMZ sources like below if you don't trust it: 
 Src: DMZ subnet 
 Service: Any 
 Target: 
 -Class A addressing range 10.0.0.0/8 
 -Class B addressing range 172.16.0.0/12 
 -Class C addressing range 193.168.0.0/16 
 Make sure the rule is above your DMZ to any rule. 
 Or you could do a DMZ source to internal LAN network objects block and place it above the dmz to any rule, either will work. 
 Emile