Jasper Yu
says to
YSITD
那就 allow icmp any any echo-reply deny icmp deny tcp any any new allow all