Dynamic deal with configuration is the easiest alternative. Only setup a DHCP client on the general public interface. The first rule accepts packets from currently established connections, assuming they are Harmless not to overload the CPU. The 2nd rule drops any packet that link monitoring ident