@p @amerika @h4890 @cjd @sj_zero @threalist ICMP probably shouldn't be entirely banned though, otherwise you'll get things like MTU issues and miss connection diagnosis (like the various distinctions of destination unreachable).

And one thing that should also be filtered out is any connection that isn't for your address/subnet, specially broadcast (where the only exception might be DHCP and SLAAC for your own machines).