This got me today. I can confirm the floating rule for ICMP solves the issue.