Hacker News new | ask | show | jobs
by xyst 813 days ago
Probably because the firewall rule only includes TCP/UDP. ICMP is often not blocked, in my experience.
1 comments

That doesn't explain the initial SYN/ACK and reply ACK which are part of the TCP establishment and that we see getting through.
It's been a very long time since I've diagnosed something like this, but I've had problems in the past when the MTU is smaller than the default and ICMP is blocked (interfering with path MTU discovery). Often IPSec or some other tunneling was involved. The initial packets got through but as soon as a full packet was sent it was dropped.

EDIT - I've now scrolled down in HN and saw that this was ruled out.