Dynamic handle configuration is the easiest alternative. Just setup a DHCP customer on the public interface. The initial rule accepts packets from now set up connections, assuming They are really Secure not to overload the CPU. The 2nd rule drops any packet that connection tracking identifies as