In some email I received from Gene ENonymous, sie wrote: > 1) Block all bound inbound packets I know are not mine > 2) block packet types I know I don't want at all. (short or controls) > 3) Check and reject packets that come from "known" bad address ranges. > 4) Then pass them in.
If "not mine" is all but one IP address, that's easy... For 3, best thing to do is define a pool with them all and use that in a single rule. Darren
