    # Find the current OutboundICMP_$$ chain, and create a new one.
    OBICMP=$(get_safe_id OutboundICMP filter find)
    new=$(get_safe_id OutboundICMP filter new)
    /sbin/iptables --new-chain $new
{
    # We want to be very selective on the ICMPs we accept to stop
    # route hijacking

    foreach my $icmpType ( 
		qw( echo-request
		    echo-reply
		    destination-unreachable 
		    source-quench
		    time-exceeded
		    parameter-problem
		) )
    {
	# FIXME: Is there any point in doing this? We have a default
	# OUTPUT policy of "allow".
        $OUT .= <<HERE;
    /sbin/iptables --append \$new --proto icmp \\
	--icmp-type $icmpType --jump ACCEPT
HERE
    }
    # Having created a new Outbound ICMP chain, activate it and 
    # destroy the old.
}
    /sbin/iptables --append $new --jump denylog
    /sbin/iptables --replace OutboundICMP 1 --jump $new
    /sbin/iptables --flush $OBICMP
    /sbin/iptables --delete-chain $OBICMP
