[stealthn]

Sorry gonna rock the boat here, but if it's a new install; ALWAYS deny first and permit after. The benfits over an above tighter security:
- You make the users/BA/Developers understand their applications better
- If you have an outbreak (inside, which is more likely than a pen outside) you can prevent the "call homes" or reverse DOS saving you from a law suit.
- SOX and other compliancy checks will fail you for not denying.

The best is to have defense in depth, router on inside doing routing and traffic shaping, firewalls doing rule enforcement, and router on outside policing traffic to prevent DOS's etc.

Good luck