The firewall can keep track of the source and destination IPs and ports for out-going UDP packets. Then, when an UDP packet comes in, it can check of these same data (though source and destination are swapped) match somewhere in the table of outgoing packets. If there is a match, the firewall may assume the incoming packet is a response - and accept it - otherwise, it may drop it.