Dynamic address configuration is the best solution. Just setup a DHCP shopper on the general public interface. The first rule accepts packets from already established connections, assuming They're Secure not to overload the CPU. The 2nd rule drops any packet that link tracking identifies as i