:INPUT,FORWARD,OUTPUT
-p icmp -m icmp --icmp-type any;=;OK
# output uses the number, better use the name?
-p icmp -m icmp --icmp-type echo-reply;=;OK
# output uses the number, better use the name?
-p icmp -m icmp --icmp-type destination-unreachable;=;OK
# it does not acccept name/name, should we accept this?
-p icmp -m icmp --icmp-type destination-unreachable/network-unreachable;=;OK
-m icmp;;FAIL
# we accept "iptables -I INPUT -p tcp -m tcp", why not this below?
-p icmp -m icmp;=;OK