[Matth]

I try to be generic, for things which ARE, and tight, for things which can be tightened without having to specify a new rule every time you do something.

DHCP can be used to misdirect your traffic - and why would somene attack YOU in that way? - well, generally, someone is attacking everyone. DNS is also restricted.

Put simply - I generally don't allow anything which is unexpected, but whwnever a new rule is required, I make it generic enough to cover all expected situations - if you HAVE a decent rules based firewall, no point setting it up like Zonealarm free (and any application needs MASSIVE justification before I'll give it anything that constitutes "Allow Server" - I have thrown "all ports outgoing" at some when anything else is just too much hassle - NEVER, except for testing and if totally desperate, would I EVER give an application "Trusted" status).