The firewall can keep track of the source and destination IPs and ports for
out-going UDP packets. Then, when an UDP packet comes in, it can check of these
same data (though source and destination are swapped) match somewhere in the
table of outgoing packets. If there is a match, the firewall may assume the
incoming packet is a response - and accept it - otherwise, it may drop it.