This may be better than allowing the bit to desynchronise your firewall's state machine. However, if you want to be nazi like that you may actually prefer not t

This may be better than allowing the bit to desynchronise your firewall's state machine. However, if you want to be nazi like that you may actually prefer not to route your network to the Internet at the IP layer but rather provide application-level proxies (IIRC Check Point products can be configured like this).