Seems like another good, DiD reason to sanitize external traffic using network gear or a secondary os transparent proxy/router like one of the 3 BSD’s.