Dynamic deal with configuration is the easiest solution. Simply just build a DHCP shopper on the public interface. The main rule accepts packets from already recognized connections, assuming These are safe not to overload the CPU. The next rule drops any packet that connection tracking identifies