net-firewall/shorewall have incomplete AllowICPMs, with leds to brokken edns0, to see if you have this problem do "dig +short rs.dns-oarc.net txt" if it says edns 512 then you miss net-firewall/ufw shorewall is okay if this is solved