Dynamic tackle configuration is the easiest solution. Basically set up a DHCP customer on the public interface. The very first rule accepts packets from presently recognized connections, assuming they are Protected not to overload the CPU. The next rule drops any packet that relationship tracking