Dynamic tackle configuration is the best possibility. Just put in place a DHCP client on the public interface. The primary rule accepts packets from now established connections, assuming They're Risk-free not to overload the CPU. The next rule drops any packet that connection tracking identif