So you think you understand IP fragmentation?

Grok! I used to think that blocking all ICMP was A Good Thing™ until I read and understood that IPv4 cannot work without ICMP. Then I modified Smoothwall Express' iptables to accept ICMP messages while retaining the option to tell the kernel to block or allow PING from the internet.