@@ -307,7 +307,10 @@ The wrapper uses upstream Tailscale packet parsing, fragment handling, flow
 tracking, and filter semantics. Packets delivered by WireGuard are checked as
 inbound before reaching the aggregate mux; host-originated packets are checked
 as outbound before encryption. Each profile owns independent filter state, so
-flows and fragments never cross profile boundaries.
+flows and fragments never cross profile boundaries. Upstream's ICMP rule admits
+echo requests whenever any match covers the source and destination IPs,
+ignoring that match's protocol and port range; empty and shields-up policies
+therefore still block new echo requests.
 
 Manifest selectors compile against WireGuard AllowedIPs ownership. Source
 selectors are restricted to address ranges the engine can authenticate, using
 
@@ -149,6 +149,13 @@ except Tailscale's reserved protocol 99; numeric TCP, UDP, and SCTP may carry
 ports. Ports are decimal 0 through 65535 and ranges must ascend. Names and
 keywords are lowercase.
 
+ICMP echo requests follow upstream Tailscale filter semantics: if any grant
+covers the source and destination pair, echo is accepted without considering
+that grant's protocol or port range. This applies to TCP, UDP, SCTP, and
+portless-protocol grants alike. An empty policy or shields-up has no such grant
+and blocks new echo requests. Explicit `icmp:*` and `ipv6-icmp:*` permissions
+remain supported. ICMP responses and errors remain allowed as reply traffic.
+
 ## Shields-up override
 
 Shields-up persistently suppresses all configured grants without changing the
 
@@ -358,6 +358,15 @@ expect_tcp_blocked() {
 	[[ $rc == 20 ]] || fail "blocked TCP flow failed for a reason other than packet timeout (status $rc)"
 }
 
+expect_ping_allowed() {
+	local source=$1 destination=$2 target ns
+	[[ $destination == a ]] && target=$effective_a || target=$effective_b
+	ns=$(namespace_for "$source")
+	if ! sudo ip netns exec "$ns" ping -n -c 2 -W 1 "$target" >/dev/null 2>&1; then
+		fail "ICMP flow covered by an upstream source/destination grant was blocked"
+	fi
+}
+
 expect_ping_blocked() {
 	local source=$1 destination=$2 target ns
 	[[ $destination == a ]] && target=$effective_a || target=$effective_b
@@ -392,20 +401,22 @@ effective_a=$(jq -er '.peers[0].effectiveAddresses[0]' "$work_dir/b-profile.json
 # with the roles reversed so each default policy is exercised.
 expect_tcp_allowed a b 18080 default-a-outbound
 expect_tcp_blocked b a 18081
+expect_ping_blocked b a
 apply_profile a tcp:18081
 apply_profile b default
 expect_tcp_allowed b a 18081 default-b-outbound
 expect_tcp_blocked a b 18080
 pass "default policy is outbound-and-replies only in both directions"
 
-# A single named-peer TCP grant admits its exact port and rejects both another
-# TCP port and a different protocol.
+# A single named-peer TCP grant admits its exact TCP port, rejects another TCP
+# port, and follows upstream behavior by admitting ICMP for the covered
+# source/destination pair.
 apply_profile a tcp:18082
 apply_profile b default
 expect_tcp_allowed b a 18082 exact-grant
 expect_tcp_blocked b a 18083
-expect_ping_blocked b a
-pass "named-peer TCP grant permits only its selected port and protocol"
+expect_ping_allowed b a
+pass "named-peer TCP grant limits TCP ports and admits upstream ICMP"
 
 # Keep a TCP connection open while removing the destination grant. Continuation
 # packets on that established flow must keep working through the policy swap.
@@ -436,6 +447,7 @@ apply_profile b tcp:18085
 expect_tcp_allowed a b 18085 before-shields
 set_shields b on
 expect_tcp_blocked a b 18085
+expect_ping_blocked a b
 apply_profile a tcp:18086
 expect_tcp_allowed b a 18086 shields-outbound
 set_shields b off
 
@@ -98,19 +98,6 @@ func prefixDestinationState(prefix netip.Prefix, local *netipx.IPSet) (string, e
 // outbound-flow state across ordinary policy replacements.
 type Policy struct {
 	filter *filter.Filter
-	icmp   *filter.Filter
-}
-
-func (p *Policy) runIn(parsed *packet.Parsed, rf filter.RunFlags) filter.Response {
-	// Upstream accepts ICMP requests when a source has any open port. Raw
-	// WireGuard grants make protocols exact, so require an ICMP-bearing grant
-	// first; upstream still recognizes response and error types in both filters.
-	if parsed.IPProto == ipproto.ICMPv4 || parsed.IPProto == ipproto.ICMPv6 {
-		if p.icmp.RunIn(parsed, rf) != filter.Accept {
-			return filter.Drop
-		}
-	}
-	return p.filter.RunIn(parsed, rf)
 }
 
 // Compile compiles cfg into an inbound allow policy. When restrictive is true,
@@ -126,9 +113,9 @@ func Compile(cfg wireguardcfg.Config, exitIP netip.Addr, restrictive bool, share
 		return nil, err
 	}
 
-	var matches, icmpMatches []filter.Match
+	var matches []filter.Match
 	if !restrictive {
-		matches, icmpMatches, err = compileMatches(cfg, ownership, localNets)
+		matches, err = compileMatches(cfg, ownership, localNets)
 		if err != nil {
 			return nil, err
 		}
@@ -137,10 +124,7 @@ func Compile(cfg wireguardcfg.Config, exitIP netip.Addr, restrictive bool, share
 	if shareStateWith != nil {
 		shared = shareStateWith.filter
 	}
-	return &Policy{
-		filter: filter.New(matches, nil, localNets, nil, shared, logger.Discard),
-		icmp:   filter.New(icmpMatches, nil, localNets, nil, nil, logger.Discard),
-	}, nil
+	return &Policy{filter: filter.New(matches, nil, localNets, nil, shared, logger.Discard)}, nil
 }
 
 // Device filters packets read from and written to an underlying TUN. Its
@@ -155,7 +139,7 @@ func NewDevice(underlying tun.Device, initial *Policy) (*Device, error) {
 	if underlying == nil {
 		return nil, fmt.Errorf("filtered TUN requires an underlying device")
 	}
-	if initial == nil || initial.filter == nil || initial.icmp == nil {
+	if initial == nil || initial.filter == nil {
 		return nil, fmt.Errorf("filtered TUN requires an initial policy")
 	}
 	d := &Device{underlying: underlying}
@@ -166,7 +150,7 @@ func NewDevice(underlying tun.Device, initial *Policy) (*Device, error) {
 // Install atomically replaces the current policy. A nil policy is rejected so
 // the device can never accidentally become allow-all.
 func (d *Device) Install(policy *Policy) error {
-	if policy == nil || policy.filter == nil || policy.icmp == nil {
+	if policy == nil || policy.filter == nil {
 		return fmt.Errorf("cannot install a nil packet filter")
 	}
 	d.policy.Store(policy)
@@ -215,7 +199,7 @@ func (d *Device) Write(bufs [][]byte, offset int) (int, error) {
 		policy := d.policy.Load()
 		var parsed packet.Parsed
 		parsed.Decode(buf[offset:])
-		if policy.runIn(&parsed, 0) == filter.Accept {
+		if policy.filter.RunIn(&parsed, 0) == filter.Accept {
 			accepted = append(accepted, buf)
 		}
 	}
@@ -334,24 +318,24 @@ func buildOwnership(cfg wireguardcfg.Config, exitIP netip.Addr) (ownership, erro
 	return result, nil
 }
 
-func compileMatches(cfg wireguardcfg.Config, owned ownership, local *netipx.IPSet) ([]filter.Match, []filter.Match, error) {
-	var matches, icmpMatches []filter.Match
+func compileMatches(cfg wireguardcfg.Config, owned ownership, local *netipx.IPSet) ([]filter.Match, error) {
+	var matches []filter.Match
 	for grantIndex, grant := range cfg.PacketFilter.Grants {
 		sources, err := resolveSources(grant.Src, owned)
 		if err != nil {
-			return nil, nil, fmt.Errorf("grants[%d]: %w", grantIndex, err)
+			return nil, fmt.Errorf("grants[%d]: %w", grantIndex, err)
 		}
 		destinations, err := resolveDestinations(grant.Dst, local)
 		if err != nil {
-			return nil, nil, fmt.Errorf("grants[%d]: %w", grantIndex, err)
+			return nil, fmt.Errorf("grants[%d]: %w", grantIndex, err)
 		}
 		if len(destinations.Prefixes()) == 0 {
 			continue
 		}
 		for _, permissionText := range grant.IP {
 			permission, err := wireguardcfg.ParsePermission(permissionText)
 			if err != nil {
-				return nil, nil, fmt.Errorf("grants[%d]: ip: %w", grantIndex, err)
+				return nil, fmt.Errorf("grants[%d]: ip: %w", grantIndex, err)
 			}
 			protocols := permissionProtocols(permission)
 			ports := filter.PortRange{First: 0, Last: 65535}
@@ -363,20 +347,9 @@ func compileMatches(cfg wireguardcfg.Config, owned ownership, local *netipx.IPSe
 				match.Dsts = append(match.Dsts, filter.NetPortRange{Net: prefix, Ports: ports})
 			}
 			matches = append(matches, match)
-			var icmpProtocols []ipproto.Proto
-			for _, protocol := range protocols {
-				if protocol == ipproto.ICMPv4 || protocol == ipproto.ICMPv6 {
-					icmpProtocols = append(icmpProtocols, protocol)
-				}
-			}
-			if len(icmpProtocols) > 0 {
-				icmpMatch := match
-				icmpMatch.IPProto = views.SliceOf(icmpProtocols)
-				icmpMatches = append(icmpMatches, icmpMatch)
-			}
 		}
 	}
-	return matches, icmpMatches, nil
+	return matches, nil
 }
 
 func resolveSources(values []string, owned ownership) (*netipx.IPSet, error) {
 
@@ -62,7 +62,7 @@ func TestCompileEnforcesSelectorsAndLongestPrefixOwnership(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			if got := policy.runIn(&test.pkt, 0); got != test.want {
+			if got := policy.filter.RunIn(&test.pkt, 0); got != test.want {
 				t.Fatalf("RunIn() = %v, want %v", got, test.want)
 			}
 		})
@@ -76,7 +76,7 @@ func TestCompileInactiveDestinationsAndExplicitSourceValidation(t *testing.T) {
 	}}}
 	policy := mustCompile(t, cfg, netip.Addr{}, false, nil)
 	pkt := parsedPacket(ipproto.TCP, "10.0.0.2", "10.0.0.1", 40000, 22, packet.TCPSyn)
-	if got := policy.runIn(&pkt, 0); got != filter.Drop {
+	if got := policy.filter.RunIn(&pkt, 0); got != filter.Drop {
 		t.Fatalf("inactive destination grant accepted packet: %v", got)
 	}
 
@@ -104,41 +104,56 @@ func TestPolicyStateSharingAndIsolation(t *testing.T) {
 		t.Fatalf("RunOut() = %v, want accept", got)
 	}
 	reply := parsedPacket(ipproto.UDP, "10.0.0.2", "10.0.0.1", 53, 41000, 0)
-	if got := base.runIn(&reply, 0); got != filter.Accept {
+	if got := base.filter.RunIn(&reply, 0); got != filter.Accept {
 		t.Fatalf("reply through base = %v, want accept", got)
 	}
 
 	shared := mustCompile(t, cfg, netip.Addr{}, true, base)
-	if got := shared.runIn(&reply, 0); got != filter.Accept {
+	if got := shared.filter.RunIn(&reply, 0); got != filter.Accept {
 		t.Fatalf("reply through shared restrictive policy = %v, want accept", got)
 	}
 	isolated := mustCompile(t, cfg, netip.Addr{}, true, nil)
-	if got := isolated.runIn(&reply, 0); got != filter.Drop {
+	if got := isolated.filter.RunIn(&reply, 0); got != filter.Drop {
 		t.Fatalf("reply through isolated restrictive policy = %v, want drop", got)
 	}
 	otherProfile := mustCompile(t, cfg, netip.Addr{}, false, nil)
-	if got := otherProfile.runIn(&reply, 0); got != filter.Drop {
+	if got := otherProfile.filter.RunIn(&reply, 0); got != filter.Drop {
 		t.Fatalf("independent profile reused flow state: %v", got)
 	}
 }
 
-func TestPolicyRequiresExplicitICMPGrant(t *testing.T) {
+func TestPolicyUsesUpstreamICMPSourceDestinationSemantics(t *testing.T) {
 	cfg := filterTestConfig()
-	cfg.PacketFilter = wireguardcfg.PacketFilter{Grants: []wireguardcfg.Grant{{
-		Src: []string{"peer:alpha"}, Dst: []string{"self"}, IP: []string{"tcp:22"},
-	}}}
 	requestBytes := icmp4Packet(8, "10.0.0.2", "10.0.0.1")
 	var request packet.Parsed
 	request.Decode(requestBytes)
-	policy := mustCompile(t, cfg, netip.Addr{}, false, nil)
-	if got := policy.runIn(&request, 0); got != filter.Drop {
-		t.Fatalf("ICMP request through TCP-only grant = %v, want drop", got)
-	}
 
-	cfg.PacketFilter.Grants[0].IP = []string{"icmp:*"}
-	policy = mustCompile(t, cfg, netip.Addr{}, false, nil)
-	if got := policy.runIn(&request, 0); got != filter.Accept {
-		t.Fatalf("ICMP request through explicit grant = %v, want accept", got)
+	tests := []struct {
+		name       string
+		permission string
+		want       filter.Response
+	}{
+		{name: "no grants", want: filter.Drop},
+		{name: "TCP grant", permission: "tcp:22", want: filter.Accept},
+		{name: "UDP grant", permission: "udp:53", want: filter.Accept},
+		{name: "SCTP grant", permission: "sctp:9", want: filter.Accept},
+		{name: "portless grant", permission: "gre:*", want: filter.Accept},
+		{name: "explicit ICMP grant", permission: "icmp:*", want: filter.Accept},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if test.permission == "" {
+				cfg.PacketFilter = wireguardcfg.PacketFilter{}
+			} else {
+				cfg.PacketFilter = wireguardcfg.PacketFilter{Grants: []wireguardcfg.Grant{{
+					Src: []string{"peer:alpha"}, Dst: []string{"self"}, IP: []string{test.permission},
+				}}}
+			}
+			policy := mustCompile(t, cfg, netip.Addr{}, false, nil)
+			if got := policy.filter.RunIn(&request, 0); got != test.want {
+				t.Fatalf("ICMP request with %q = %v, want %v", test.permission, got, test.want)
+			}
+		})
 	}
 }
 
@@ -148,19 +163,19 @@ func TestPolicyPreservesUpstreamTCPAndICMPSemantics(t *testing.T) {
 	policy := mustCompile(t, cfg, netip.Addr{}, false, nil)
 
 	tcpContinuation := parsedPacket(ipproto.TCP, "10.0.0.2", "10.0.0.1", 22, 40000, packet.TCPAck)
-	if got := policy.runIn(&tcpContinuation, 0); got != filter.Accept {
+	if got := policy.filter.RunIn(&tcpContinuation, 0); got != filter.Accept {
 		t.Fatalf("TCP continuation = %v, want accept", got)
 	}
 	tcpSYN := parsedPacket(ipproto.TCP, "10.0.0.2", "10.0.0.1", 22, 40000, packet.TCPSyn)
-	if got := policy.runIn(&tcpSYN, 0); got != filter.Drop {
+	if got := policy.filter.RunIn(&tcpSYN, 0); got != filter.Drop {
 		t.Fatalf("TCP SYN = %v, want drop", got)
 	}
 	icmpReply := parsedPacket(ipproto.ICMPv4, "10.0.0.2", "10.0.0.1", 0, 0, 0)
 	icmpReply.StuffForTesting(28)
 	// ICMP echo reply type.
 	icmpReplyBytes := icmp4Packet(0, "10.0.0.2", "10.0.0.1")
 	icmpReply.Decode(icmpReplyBytes)
-	if got := policy.runIn(&icmpReply, 0); got != filter.Accept {
+	if got := policy.filter.RunIn(&icmpReply, 0); got != filter.Accept {
 		t.Fatalf("ICMP response = %v, want accept", got)
 	}
 }