@garyw:
if I ping from another machine on the LAN to the OPT1 interface I get a reply.
That is the expected behaviour. I assume you mean another machine on the OPT1 subnet but the same would be true for the OPT1 interface itself.
There is a default firewall rule on LAN that allows all traffic to anywhere. 'anywhere' includes the OPT1 subnet so pings from a LAN client can reach an OPT1 client. The ping response is allowed back because the state has been opened already. If you tried to do the same in reverse, ping a LAN client from the OPT1 subnet, you'll find it is blocked.
If you don't want that to hapen you have to modify the default LAN rules to be more restrictive.
Steve