> What type of rule could you write to block same src/dst traffic. This is > inregards to blocking land attacks coming in from the outside interface. I have rules blocking incoming traffic with source ip-addresses from my own network. If you don't have a transit gateway this should be a simple solution to avoid land attacks.
