This is quite an over simplification but a large amount of the filtering, if placed close to the client, is a single line of config.

"ip verify unicast source reachable-via rx" in the Cisco world.