Try using IPSec filtering to allow ICMP internally and deny ICMP-ECHO REPLY externally.