This will work, but it includes several security risks.
First of all, you may want to exclude the priviliged ports from the
source addresses, especially because the above rule also allows _incoming_
sessions from port 80 on any host to any internal port. This is _unsafe_.
(In fact, you need to exclude all ports on which servers are running).
So, you should use the -k (TCP ACK) option in this command.
Including the -k in the above command will not allow any new sessions
being initiated from the outside, because it requires the TCP ACK flag
being set on all incoming packets. And, the first TCP packet, which is
sent _from_ you to the outside word, of a session doesn't carry this flag.
When using the -k option, the need for excluding the priviliged ports
is overruled, but I always try to define rules as restrictive
as possible.
-- -- Jos Vos <jos@xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204