Sep 22 23:37 2015, Benny Pedersen wrote to Markus Reschke:
BP> my own qqustion is more on how to allow ICMP in safe mode, lan and BP> wan side, gateway wide or local only, see my own shorewall6 dump i BP> have sent here before
You don't have to reinvent the wheel. Simply read RFC4890.
BP> how to make windows behave aswell is not my problem :=)