I want to allow ping replies on ppp1 in the fw script, how do I do that?

Question

I've tried this:
pass in break end on ppp 1 proto icmp icmp-type echorep code 0

But it does not work.

Any tips?

Cheers,
John

Answer 1

Try the following. You don't want an inbound rule because you only want the matched reply.

pass out break end on ppp 1 proto icmp from addr-ppp 1 icmp-type echo inspect-state

Answer 2

I got this to work actually doing this:
pass in break end proto icmp icmp-type echo

I have to let the ping IN before the router can answer it.

This was the only line I had to add to make it work. Since I only enable the FW on the ppp1 interface, I can leave that part of it out.

Cheers,
John