diff --git a/defaults/main.yml b/defaults/main.yml
index c901a16..86b73ef 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -261,6 +261,8 @@ nft_input_default_rules:
     - ip6 daddr @ip6blackhole counter drop
   015 localhost:
     - iif lo accept
+  050 icmp:
+    - meta l4proto {icmp,icmpv6} accept
   200 input udp accepted:
     - udp dport @in_udp_accept ct state new accept
   210 input tcp accepted: