Why don't I get ICMP echo replies without setting the Don't Fragment flag?

Question

I am using my phone's wireless hotspot to provide temporary/backup internet access through my router. The router is connecting to the phone as a Wi-Fi client and using that Wi-Fi connection as an upstream internet connection when the main wired one fails. This is probably at least a triple NAT.

The routing and firewalling is set up so that IPv4 connectivity works fine for all clients connected to the router, but I have discovered that pinging internet hosts works on Linux clients but does not work from Windows clients. The Windows ICMP echo requests go out over the router's Wi-Fi interface, but no reply ever comes back.

The firewall is set to allow all ICMP in both directions, using the same settings as my main wired internet connection, which has no trouble with ICMP (although it has only one layer of NAT.)

I have discovered by comparing working and non-working pings via tcpdump on the router that Linux is setting the Don't Fragment bit by default and Windows is not. If I give Windows ping the -f option, the Don't Fragment bit gets set and I get ICMP echo replies on Windows.

According to tcpdump, the size of the echo request from Windows ping is 40 bytes, from Linux it is 64 bytes. I've researched this a bit but most everything I could find was regarding discovering MTU size by sending large ping packets, and these are small.

Why does turning on the Don't Fragment bit make ping work in this setup?

Answer 1

This shouldn't be happening, since small packets should work well without the DF flag.

You might perhaps be hitting an external firewall that protects against ping flood, which is a type of denial-of-service attack.

In this attack, the attacker will fragment a large message into very small packets, requiring the target to keep the fragments in memory in order to assemble them into one complete packet when the last fragment is received. In this way the attacker can fill up the victim's memory with never-ending packet streams.

Perhaps the phone's ISP is over-sensitive about small packets without the DF flag, rejecting them all.