Blocking ICMP creates problems later

ICMP was blocked entirely "for security". Days later: some sites unreachable, large transfers dying halfway, occasional TLS timeouts.

Beyond echo, ICMP carries destination unreachable — including fragmentation needed — and time exceeded. Block it all and PMTUD breaks, so paths with an MTU below 1500 silently drop large packets.

Allow what is needed and rate-limit the rest:

-A INPUT -p icmp --icmp-type echo-request -m limit --limit 10/s -j ACCEPT
-A INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT
-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT

The rate limit on echo defends against amplification; it does not require blocking everything. If you want the host to look quiet, DROP rather than REJECT — but keep your own debugging tools working.