trouble with ICMP requests

Hi,

I am unable to figure out why "lan" hosts can ping 13.107.4.51 and
13.107.4.53 but not 13.107.4.52 (www.msftconnecttest.com).
From the Shorewall Firewall itself I **can** ping 13.107.4.52.
From that same firewall if I run the following command I see no ICMP
requests when pinging from a host in lan/lan1/lan13 zones:

# tcpdump -n -i wan host 13.107.4.52 and icmp
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wan, link-type EN10MB (Ethernet), capture size 262144 bytes
^C
0 packets captured
36 packets received by filter
0 packets dropped by kernel

The wan interface is for the wan zone (internet).

However, I do see ICMP requests coming in on the local interface:

# tcpdump -n -i lan.1 host 13.107.4.52 and icmp
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lan.1, link-type EN10MB (Ethernet), capture size 262144 bytes
11:07:30.787799 IP 10.215.111.210 > 13.107.4.52: ICMP echo request, id
1, seq 30901, length 40
11:07:35.570882 IP 10.215.111.210 > 13.107.4.52: ICMP echo request, id
1, seq 30902, length 40

If I trace ICMP traffic for the other 2 IP addresses I can see both
requests and replies on the wan interface:

# tcpdump -n -i wan host 13.107.4.51 and icmp
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wan, link-type EN10MB (Ethernet), capture size 262144 bytes
11:10:32.783603 IP 10.215.111.210 > 13.107.4.51: ICMP echo request, id
1, seq 30918, length 40
11:10:32.798775 IP 13.107.4.51 > 10.215.111.210: ICMP echo reply, id
1, seq 30918, length 40
11:10:33.788524 IP 10.215.111.210 > 13.107.4.51: ICMP echo request, id
1, seq 30919, length 40
11:10:33.803409 IP 13.107.4.51 > 10.215.111.210: ICMP echo reply, id
1, seq 30919, length 40

I have no special rule for 13.107.4.52 so I don't understand why the
ICMP requests (or HTTP requests for that matter) are not going out the
wan interface.

Any clues?

A shorewall dump taken while pinging from lan.1 host with IP addr.
10.215.111.210 to 13.107.4.52 can be found here:

https://drive.google.com/file/d/1yMBPe1skzmg9Y5wzYXvKLsaQyPELHreu/view?usp=sharing

Regards,

Vieri