Dynamic address configuration is the simplest alternative. Just build a DHCP client on the general public interface.The first rule accepts packets from already founded connections, assuming they are safe not to overload the CPU. The second rule drops any packet that link tracking identifies as invalid. After that, we arrange normal accept policies