firewall: Allow ICMP always