Curious about strange ICMP type 3 code 10 traffic to my IP address

Question

My firewall (iptables) logs some strange ICMP type 3 code 10 traffic that I am curious to understand (specifically how or if this could be an exploit of some sort).

Type 3 = Destination Unreachable
Code 10 = Communication with Destination Host is Administratively Prohibited).

The logged traffic (4-6 packets a few seconds apart, once a day for the last months):

IN=eth0 OUT= MAC=(eth0 MAC) SRC=(Foreign IP address) DST=(My IP address) LEN=72 TOS=0x00 PREC=0x00 TTL=50 ID=35145 PROTO=ICMP TYPE=3 CODE=10 [SRC=(My IP address) DST=(Foreign IP address) LEN=44 TOS=0x00 PREC=0x00 TTL=50 ID=0 DF PROTO=TCP SPT=25 DPT=53454 WINDOW=28200 RES=0x00 ACK SYN URGP=0]

All logs indicate that (Foreign IP address) only transmits the above ICMP packet.
No other traffic from (Foreign IP address) is recorded in the same time period (see update below).
By default, the system logs and drops any traffic originating from the country of (Foreign IP address).

Could this be an exploit, perhaps to trick (My IP address) into transmitting something to (Foreign IP address), assuming I did not drop the traffic by default?

Any insights are welcome.

Update: The logs show that (Foreign IP address) consistently connects to port 80 and 443 prior to the ICMP packets (9 and 7 hours before the ICMP packets, respectively). Both attempts dropped by the default firewall policy.
According to Network-Tools.com the origin of (Foreign IP address) is China(CN) in region Southern and Eastern Asia, and no host name is associated with the IP address.

Answer 1

ICMP type 3 code 10

This implies it's a response to you from another firewall. If I have an iptables rule that ends with:

REJECT --reject-with icmp-net-prohibited

and a request from you is covered by this rule, you will receive a code 10 type 3 ICMP packet to inform you the port is unreachable by you. This is considered the correct response, as opposed to DROP, which sends no response and hence will tend to generate more traffic to the "unreachable" address to solve the mystery.¹

If this is the case, you should figure out why this is being rejected by your firewall and correct the rules, because it will cause applications to hang unnecessarily. Possibly you have something too early in the list, or no proper RELATED, ESTABLISHED rule.

Is this some sort of ICMP policy, to trick (My IP address) into transmitting something to (Foreign IP address), assuming I did not drop the traffic by default?

Unlikely, since there's no reply expected.

---

^{1. Using DROP as a security by obscurity mechanism on a public server is completely pointless since all a legitimate attacker must do is a port scan; one of them has to respond to something or else it isn't a public server. Further, it generates unnecessary additional traffic and problems for systems that aren't bogey men (i.e., most of them). If you want to deny access, just say you are denying access. You should only use DROP with traffic you are aware of but wish to ignore, such as broadcast packets from local systems.}