Apply firewall rules on ICMP

[ignoramous]

ICMP messages may be used to exfiltrate data: https://archive.is/OaV7K but the underlying LwIP stack doesn't expose handler to any other protocol-type other than UDP or TCP, which means the firewall rules don't get to process ICMP messages.

So: Either add ICMP handlers to LwIP and access it through go-tun2socks or attempt a switch to gVisor NetStack.

[ignoramous]

netstack take 2: https://github.com/celzero/firestack/tree/n2/

[ignoramous]

Instead of the forked fdbased impl, we could use upstream's; see: google/gvisor#7125 and xjasonlyu/tun2socks#82

[ignoramous]

34be365