Block dangerous LAN traffic

It’s still not clear exactly what we want to do with LAN traffic in general (XXX: this should really have a ticket), but on the short run, at least a minimal blacklist of known-bad traffic should be blocked:

It was reported that NAT-PMP can be used to discover the LAN’s external IP-address on the Internet.

Team: DrWhax, ? (team mate)

Related issues

Related to #5340
Blocked by #7976 (closed)
Blocked by #15167

Original created by @tails on 5293 (Redmine)

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information