Couldn't block icmp responses on WAN interface

Guest

Hi
I defined a simple rule on WAN interface to block icmp responses. but i can still ping 4.2.2.4 from my LAN.

Action: Block
Interface: WAN
Protocol: ICMP
ICMP type: Any
Source type: Any
Destination: Any

If i add a floating rule for "in" direction on WAN, it doesn't block icmp responses too. this rule only works for "out" direction to block icmp requests.
this problem remains when i change protocol field to any.

Is this a bug? Can you help me to solve the problem?

johnpoz

If you don't want users to ping from your lan - then you put the rule on your LAN interface, not your WAN.

Firewall rules are seen as inbound to the interface, not outbound. You would not block the response - since there is a state for the outbound traffic you allowed to come back in.

If you don't want your lan to be able to ping stuff, then put the rule on your LAN, or on your floating tab for your LAN interface.