ICMP Ruleset Behavior

--001a1130cd4e10853a0538d285d1
Content-Type: text/plain; charset=UTF-8

Greetings,

Trying to replicate some functionality with PF that I had with a cisco
asa.  I'm trying to explicitly allow echo requests outbound and only echo
replies inbound but it's not working.  Here's my current rules for this,
but I can't ping anything beyond the external interface though.

pass out quick on egress inet proto icmp icmp-type echoreq no state
pass in quick on egress inet proto icmp icmp-type echorep no state
block quick on egress inet proto icmp all

If I remove the 'no state' part, I can ping, but I don't need the second
line which I don't really understand why I don't.   So I guess my questions
are, why does the above ruleset not work, and why does it work if I remove
'no state' or use default of keep state but comment out the second rule?
Shouldn't the echoreply packets be getting blocked on the way back in?

What am I missing?  Do i need to do something with NAT's?

Thanks

--001a1130cd4e10853a0538d285d1
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Greetings,</div><div><br></div><div>Trying to replica=
te some functionality with PF that I had with a cisco asa.=C2=A0 I&#39;m tr=
ying to explicitly allow echo requests outbound and only echo replies inbou=
nd but it&#39;s not working.=C2=A0 Here&#39;s my current rules for this, bu=
t I can&#39;t ping anything beyond the external interface though.</div><div=
><br></div><div><div>pass out quick on egress inet proto icmp icmp-type ech=
oreq no state</div><div>pass in quick on egress inet proto icmp icmp-type e=
chorep no state</div><div>block quick on egress inet proto icmp all</div></=
div><div><br></div><div>If I remove the &#39;no state&#39; part, I can ping=
, but I don&#39;t need the second line which I don&#39;t really understand =
why I don&#39;t. =C2=A0 So I guess my questions are, why does the above rul=
eset not work, and why does it work if I remove &#39;no state&#39; or use d=
efault of keep state but comment out the second rule?=C2=A0 Shouldn&#39;t t=
he echoreply packets be getting blocked on the way back in?</div><div><br><=
/div><div>What am I missing?=C2=A0 Do i need to do something with NAT&#39;s=
? =C2=A0<br></div><div><br></div><div>Thanks</div></div>

--001a1130cd4e10853a0538d285d1--