Firewalling and MASQ

[Stephen L. Favor]

I would like to configure a box to forward only TCP and
UDP packets associated with a MASQ session and I can't quite
figure out a way to do it.  I can open 61000:65096 to the world
and MASQ works fine, but I would prefer only let the ports with
active sessions through the firewall.  Can anyone tell me how to
do this?