Weren't you using NAT? And leaving out the command you used to get the tcpdump also doesn't help.
If you want to see what is going on with your pings: disable NAT, use a simple pf.conf with a default block log all and only passing out ICMP stateful, and for your tcpdump commands use -n to disable name lookups and -e to see the link level or MAC address.
__________________
You don't need to be a genius to debug a pf.conf firewall ruleset, you just need the guts to run tcpdump
|