Palo Alto ultimate plan

My router use VPN to protect traffic outside firewall, so only need to one country. 

My design first rule is to block private and multicast address.

Then block hackers countries

Then block MITRE web mentioned malicious ports in two directions

Ultimate war of firewall

A new concept corrected when past is wrong

This correct concept is that when going to internet, home should DMZ, and use guest wifi.