yes you need to allow ICMP for status checks but this is actually a minor fluke. We've removed it for the next release so it will go away soon