Search:

Try using IPSec filtering to allow ICMP internally and deny ICMP-ECHO REPLY externally.

Grumble, how did I gt this in the wrong thread?

You can use IPSec rules to allow IMCP internally and deny ICMP-ECHO replies externally. This will still allow pinging inside the network itself.