apparently this is a known bug only for icmp - make target match all protocols but...