IP Chains question

[Matt Kopishke <kopishke@BlueNoteTechnology.com>]

I have set up a firewall using ipchains and the bridge patch
(bridgein) under potato (2.2.19).  The one snag I had was although the
firewall works well only letting the world see certain ports (80 & 443),
it doesn't let the servers behind the firewall get out.  I set up a rule
that allows all traffic that originated behind the firewall out, but
because we only have a couple of ports open, and we have no clue what port
the reply packets are going to come on, the reply packets get denied.

I was wondering if there is any way to mark out going packets so we can
let them through on their way back?

Thanks,

Matt