For ISP: How to ***really*** block invalid ICMP, TCP, UDP packets and others (ver. 2021)

[DarkNate]

Yes, but is clearly indicated:
Warning: this two rules can break the Path MTU Discovery (PMTUD), use only if your device are sensible to “Large ICMP” or “Ping of Death” attack.
On doubt, do not use at all!!!

3. Thanks, added on future update.

ICMP Completely removed, to avoid problems.
In Italy there is a saying: The mother of idiots is always pregnant.

This would still break jumbo frame sized packets. Remove these both as well.

add action=drop chain=prerouting comment="ICMP large packet attack" packet-size=1601-65535 protocol=icmp
add action=drop chain=prerouting comment="ICMP fragmentation attack" fragment=yes protocol=icmp