macro.allowicmps

sharewall is very good

#
# Shorewall version 4 - AllowICMPs Macro
#
# /usr/share/shorewall/macro.AllowICMPs
#
#	This macro ACCEPTs needed ICMP types
#
###############################################################################
#ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
#				PORT(S)	PORT(S)	LIMIT	GROUP

COMMENT Needed ICMP types

ACCEPT	-	-	icmp	fragmentation-needed
ACCEPT	-	-	icmp	time-exceeded
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE