> The biggest challenge for implementing this will probably be figuring out how to block inbound connections but keep outbound connections working. nah, there'

> The biggest challenge for implementing this will probably be figuring out how to block inbound connections but keep outbound connections working. nah, there's connection tracking for that. ctstate new srcip <amazon-set> drop