Firewall: Update config template and enable port/syn flood protection by default. Disable incoming ping/ICMP.

This will not help much if large DDoS flood saturates your network connections, but still offers good protection against standard DoS attempts.