enable
configure terminal

interface GigabitEthernet0/1
 no ip access-group DMZ-OUT in
 exit

no ip access-list extended DMZ-OUT

############################################

ip access-list extended DMZ-OUT

permit tcp 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255 established

permit icmp 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255 echo-reply

permit tcp 192.168.20.0 0.0.0.255 any established

deny ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255

deny ip 192.168.20.0 0.0.0.255 any

exit

####

interface GigabitEthernet0/1
 ip access-group DMZ-OUT in
exit

end
write memory

#########

show ip access-lists DMZ-OUT