1*57718be8SEnji Cooperpass in proto tcp all flags S keep state(icmp-head icmpredir) 2*57718be8SEnji Cooperblock out proto icmp all icmp-type redir group icmpredir 3