Dynamic deal with configuration is the best option. Simply setup a DHCP consumer on the public interface. The very first rule accepts packets from previously set up connections, assuming They're Safe and sound to not overload the CPU. The 2nd rule drops any packet that link monitoring identif