Dynamic tackle configuration is the best choice. Simply arrange a DHCP client on the public interface. The primary rule accepts packets from now established connections, assuming They may be Protected not to overload the CPU. The next rule drops any packet that link tracking identifies as invalid