This is true of IPv4 ICMP as well. Same PMTU issues, but many IPv4 implementations fallback to allowing in-path packet fragmentation by the routers (which IPv6

This is true of IPv4 ICMP as well. Same PMTU issues, but many IPv4 implementations fallback to allowing in-path packet fragmentation by the routers (which IPv6 discontinued), which is less visible breakage but still inefficient/problematic. It's also slightly more complicated than "outbound allow, inbound deny" because you want to accept reply packets to the outbound ones, using something like the iptables "-m state --state related,established" match.