Which firewall rules make a classic DMZ work, on the internal side and on the internet side?

Internal side: clients may reach the DMZ only for administration (client -> dmz: allow ssh), and dmz <-> internal: deny all. Internet side: each public service gets exactly its own protocol — internet <-> dns: allow dns, internet <-> mailex: allow email, internet -> webserver: allow http(s) — and nothing else.

* The outer firewall opens one protocol per public server; the inner firewall lets nothing from the DMZ into the LAN. *

The two rule sets express two different trust decisions:

• Outer firewall (internet ↔ DMZ): the internet may talk to the DMZ servers, but only in the one protocol each server exists to offer. The web server is reachable with HTTP(S), the mail exchanger with email (SMTP), the DNS server with DNS. Note the direction: the web server only receives (->), while DNS and email work in both directions (<->), because the mail exchanger also sends mail out and the DNS server also queries other name servers.
• Inner firewall (DMZ ↔ internal LAN): the DMZ is treated as untrusted. Nothing in it may open connections into the LAN, and nothing in the LAN talks to it except administrators connecting in (SSH or similar) to maintain the servers.

The key consequence: a server that is compromised from the internet ends up in a zone from which it cannot reach the internal systems.

Go deeper:

• NIST SP 800-41 Rev. 1 — Guidelines on Firewalls and Firewall Policy — firewall architectures including DMZs, and how to write the policy for them.
• Network segmentation — Wikipedia — why splitting a network into zones limits the damage of a breach.