Starting with rate-limiting for ICMP, to avoid an attacker to forge ICMP Error messages and pierce the NAT. See comment https://github.com/githedgehog/dataplane/pull/934#discussion_r2461223975