Dynamic tackle configuration is the best possibility. Simply create a DHCP shopper on the general public interface. The main rule accepts packets from already founded connections, assuming They are really Harmless not to overload the CPU. The next rule drops any packet that connection monitoring