The problem is not ICMP packets going from the LAN to WAN, it's the other way round. It works fine for IPv4, but not IPv6. The firewall is allowing LAN machines to be pinged from the WAN, despite unchecking the "Allow ICMP through Gateway from external networks" option - surely this would mean that internal machines are not visible to ICMP? If you have any other option ticked, then there is no change in function with the "Allow ICMP through Gateway from external networks" option - it will always allow packets from the WAN to LAN via IPv6.
↧