How do I allow ICMP echo reply for a host on a LAN that is reached from outside using a DNAT?

Here is what you need to do:

- Define a DNAT rule: WanInterface -- Any -- webserver - Any

- Define an ICMP Echo request service

- Define an ICMP Echo reply service

- Setup a packet filter rule Any - ICMP echo request - Webserver - Accept

- Setup a packet filter rule Any - ICMP echo reply - Webserver - Accept

- Setup a packet filter rule Webserver - ICMP echo request - Any - Accept

- Setup a packet filter rule Webserver - ICMP echo reply - Any - Accept