diff --git a/Shorewall-core/lib.cli b/Shorewall-core/lib.cli
index a3ffea2b4..d06a938a0 100644
--- a/Shorewall-core/lib.cli
+++ b/Shorewall-core/lib.cli
@@ -2089,6 +2089,8 @@ delete_command() {
 open_close_command() {
     local command
     local desc
+    local proto
+    local icmptype
 
     open_close_setup() {
 	[ -n "$g_nolock" ] || mutex_on
@@ -2152,7 +2154,11 @@ open_close_command() {
 	desc="from $1 to $2"
 
 	if [ $# -ge 3 ]; then
-	    command="$command -p $3"
+	    proto=$3
+
+	    [ $proto = icmp -a $g_family -eq 6 ] && proto=58
+
+	    command="$command -p $proto"
 
 	    case $3 in
 		[0-9]*)
@@ -2162,22 +2168,57 @@ open_close_command() {
 		    desc="$desc $3"
 		    ;;
 	    esac
+
+	    if [ $g_family -eq 4 ]; then
+		if [ $proto = 6 -o $proto = icmp ]; then
+		    proto=icmp
+		    icmptype='--icmp-type'
+		fi
+	    else
+		if [ $proto = 58 -o $proto = ipv6-icmp ]; then
+		    proto=icmp
+		    icmptype='--icmpv6-type'
+		fi
+	    fi
 	fi
 
 	if [ $# -eq 4 ]; then
-	    command="$command -m multiport --dports $4"
+	    if [ $proto = icmp ]; then
+		case $4 in
+		    *,*)
+			fatal_error "Only a single ICMP type may be specified"
+			;;
+		    [0-9]*)
+			desc="$desc type $4"
+			;;
+		    *)
+			desc="$desc $4"
+			;;
+		esac
 
-	    case $4 in
-		[0-9]*,)
-		    desc="$desc ports $4"
-		    ;;
-		[0-9]*)
-		    desc="$desc port $4"
+		command="$command $icmptype $4"
+	    else
+		case $4 in
+		*,*)
+		    command="$command -m multiport --dports $4"
 		    ;;
 		*)
-		    desc="$desc $4"
+		    command="$command --dport $4"
 		    ;;
-	    esac
+		esac
+
+		case $4 in
+		    [0-9]*,)
+			desc="$desc ports $4"
+			;;
+		    [0-9]*)
+			desc="$desc port $4"
+			;;
+		    *)
+			desc="$desc $4"
+			;;
+		esac
+	    fi
 	fi
 
 	command="$command -j ACCEPT"