ASA-style: TCP and UDP rules, tested with packet-tracer
SRV in the DMZ may send web traffic (TCP 80 and 443) and DNS (UDP 53) out, and nothing else. The simulator only sends pings, so test the rule with packet-tracer, which walks a made-up packet through the same steps as real traffic: route lookup, access rule, NAT, inspection and flow creation.
The simulator ticks each one as soon as the network meets it.
Create object-group service WEB tcp with port-object eq www and eq https.
Create access-list DMZ-IN: permit tcp host 172.16.1.10 any object-group WEB, and permit udp host 172.16.1.10 any eq domain. Apply it in on the dmz interface.
packet-tracer from the dmz: TCP to 198.51.100.1 port 443 and UDP port 53 are allowed.
TCP port 22 and a ping from SRV are dropped by the access rule.
