Should not the Any via any -> internal rule drop ping as well?
no, this behaviour is the same in V8 as it was in V7 and before The settings in the "icmp settings" are located in the "Auto" chains of iptable, and the "manual" packetfilter rules are located in the USR-chains, which are always applied AFTER the AUTO chains
Because having all ping or no ping is not really a nice alternative - I want to ping out but not ping in.
like in V7, you should be able to selectively allow ICMP from inside to outside but not vice versa by doing it like this: - do NOT check the "firewall forwards ping" check box - create a packetfilter rule for the ICMPs which you want to pass
