The stateless ruleset that blocks inbound connection initiation

Answer

# no outside host may OPEN a TCP connection to 192.168.7.56 1 in outside 192.168.7.56 tcp dport 80 syn,!ack deny 2 in outside 192.168.7.56 tcp dport 80 ack permit 3 out 192.168.7.56 outside tcp permit 4 any any any any deny

Rule 1 is the answer: SYN set with ACK clear is the only segment that initiates. Rule 2 keeps the replies to the server own outbound sessions flowing, and rule 4 writes the default policy down.

Stallings & Brown, Computer Security 5e, ch9 section 9.3