Dynamic tackle configuration is the simplest solution. Just build a DHCP consumer on the public interface. The primary rule accepts packets from already proven connections, assuming They are really Secure not to overload the CPU. The 2nd rule drops any packet that connection tracking identifies a