我目前正在 Solaris 机器上使用数据包过滤器，试图创建一个规则来过滤掉所有特定类型和代码的 ICMP 数据包。这是我的规则：
block out quick proto icmp from any to <MY_TABLE_34> icmp-type 3 code 1
我收到错误“必须使用 icmp 类型/代码指示地址系列”。这是否意味着我不能在指定 ICMP 类型和代码的规则中使用表？如果是这种情况，那么有没有比为表中的每个地址编写单独的规则更好的方法？
操作系统：Solaris 11.4
我有两个接口，一个是 net0 和 192.168.0.30 ip，另一个是 vnic0 和 10.2.0.1 ip
这是我的 pf.conf，solaris 是 11.4
ext_if="net0"
int_if="vnic0"
localnet="192.168.0.0/24"
internalnet="10.2.0.0/24"
int_tcp_services = "{www, https}"
int_udp_services = "{domain}"
set skip on lo
set loginterface $ext_if
block return in log all
block out all
antispoof quick for $ext_if
# Block 'rapid-fire brute force attempts
table <bruteforce> persist
block quick from <bruteforce>
#enable icmp for localnet
pass inet proto icmp from $localnet to any keep state
pass inet proto icmp from $internalnet to any keep state
pass inet proto icmp from any to $ext_if keep state
pass inet proto icmp from any to $int_if keep state
# SSH is listening on port 22
pass in quick proto tcp to $ext_if port 22 keep state (max-src-conn 15, max-src-conn-rate 5/3, overload <bruteforce> flush global)
# bind is listening on port 53
pass in quick proto tcp to $int_if port 53 keep state
pass in quick proto udp to $int_if port 53 keep state
# Allow essential outgoing traffic
pass out quick on $ext_if proto tcp to any port $int_tcp_services
pass out quick on $ext_if proto udp to any port $int_udp_services
禁用防火墙的所有接口都接受 Ping 仅在启用防火墙的情况下，net0 才接受 Ping。
有什么解决办法吗？