Actually I think you might still be right. Ping uses ICMP, which is almost never blocked in my experience. I learned that because early in my career I too assumed a successful ping = TCP and UDP also work.

Filtering + established connection tracking:

https://news.ycombinator.com/item?id=39822214