Here are the ICMP types supported by FreeBSD / OpenBSD PF firewall:
Here is the pf.conf syntax for allowing icmp packets:
Code:
icmp_types="{ echoreq, unreach}"
pass in log on $ext_if1 inet proto icmp from any to $dmz_net icmp-type $icmp_types keep state #queue icmp
And below is a list of supported icmp types:
Quote:
"net-unr",
"host-unr",
"proto-unr",
"port-unr",
"needfrag",
"srcfail",
"net-unk",
"host-unk",
"isolate",
"net-prohib",
"host-prohib",
"net-tos",
"host-tos",
"filter-prohib",
"host-preced",
"cutoff-preced",
"redir-net",
"redir-host",
"redir-tos-net",
"redir-tos-host",
"normal-adv", ...