I've got several old CentOS 4.x systems and have configured iptables to allow ICMP traffic.
Originally, I had an iptables rule that looked like:
-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
That seemed to work fine for awhile but one of our monitoring solutions has a requirement to ping more often than once a second (long story but in short, it's a requirement).
To accommodate this, I changed the rule to:
-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request -j ACCEPT
The strange part is that I have this same rule on multiple CentOS 4.x servers and most are handling this fine but one of them is still intermittently not sending echo ping replies.
I've confirmed that the IPTables rule is the same between all servers. Any thoughts on what could be going on here?
For good measure, I collected a packet capture on the CentOS server side but all I'm seeing is the server intermittently sending back an ICMP Type 3 / Code 1 message about the destination and host being unreachable (which seems strange to me considering that it's the box itself that is responding with this message).