The other thing tho remeber about stateful packet inspection is that because the firewall 'knows' that a valid connection has been set up, any reply packets from the outside world relating to that connection are allowed back through. The good thing about this is you only have to set up one set of rules to allow the connections you want - you don't have to set up a whole matching or mirror-image set to allow replies to all the connections you want as well. In earlier (and simpler) firewalls you had to do that.
