diff --git a/Shorewall/firewall b/Shorewall/firewall
index c67cc1290..de2e55df0 100755
--- a/Shorewall/firewall
+++ b/Shorewall/firewall
@@ -3196,18 +3196,13 @@ initialize_netfilter () {
     setcontinue INPUT
     setcontinue OUTPUT
 
-    #
-    # Make 'traceroute -I' work
-    #
-    run_iptables -I OUTPUT -p icmp --icmp-type time-exceeded -j ACCEPT
-
     #
     # Allow DNS lookups during startup for FQDNs and deep-six INVALID packets
     #
 
     for chain in INPUT OUTPUT FORWARD; do
 	run_iptables -A $chain -p udp --dport 53 -j ACCEPT
-	run_iptables -A $chain -m state --state INVALID -j DROP
+	run_iptables -A $chain -p ! icmp -m state --state INVALID -j DROP
     done
 
     [ -n "$CLAMPMSS" ] && \