Obviously the sensible thing to do seems to be to use stateful firewalling and only allow ICMP which is related to a permitted existing connection.

Then you will still get useful unreachables etc through, but should not have any unsolicited random IP leaking in.

AFAIK, Linux ipfw (+ conntrack) and BSD firewalling can both do this.

Slarty