Dynamic tackle configuration is the best option. Just put in place a DHCP shopper on the general public interface. The initial rule accepts packets from now set up connections, assuming These are Secure not to overload the CPU. The 2nd rule drops any packet that connection tracking identifies as