The match rule does not block or pass. It sets options on matching rules, which will apply to later block or pass rules.
You had no later block or pass rule to which the match could be applied.
Incidentally, with standard filtering rules, the last matching rule is applied, so your pass rule for icmp packets is moot. It will never be applied as the following two rules will match all incoming packets.
|