Re: Better rules?

I'm glad I said it "probably" won't be easy.

My system generated a small flood of UDP requests when I first tried this. Most were from my ISP: port 67 (bootps), port 68 (bootpc), and DNS-related. The unwary could get into trouble blocking these.

I think the OSX firewall blocks inbound ICMP if set as stealth.