[tor-relays] How to prevent netscan usage?

[grarpamp]

> First rule is to use some firewall

No it is not, do not do this.
An exit needs to pass the traffic that its exitpolicy says it will pass.
Otherwise bad things happen with circuit construction and your exit
gets badmouthed by users possibly to the point of being banned. If
you can't provide an exitpolicy that works as written, then don't provide it.