I'm use to KPF 2.1.5, but have kpf 4.1 on a machine. I can't ping that machine unless I disable the Network Security Module. There are *no* rules in that module that denay anything -- all rules either permit or ask the user. The incoming ping does not cause a box to pop up to ask the user. I also clicked the Packet Filter button on this module, and unchecked Deny All. Still doesn't allow incoming pings. From the lack of denial rules, it seems like nothing should block incoming pings. Why would it do this?
I ended up testing the firewall with ping because of problems ssh'ing to that machine. It turns out that the disabling the Network Security module also allows ssh to connect. So the same question as to why also applies to ssh.