Confused about “iptables” chains and why some traffic is blocked but not other traffic

Question

When I add these rules to INPUT:

-A INPUT -p icmp -m icmp --icmp-type 8 -m recent --name ping --set
-A INPUT -m recent --name ping --hitcount 3 --rcheck --seconds 20 -j DROP

this will ban (all connection types) from the IP address(es) from the ping list – those who try to ping 3 times in 20 seconds.

However, when I redirect the traffic to another chain:

-A INPUT -p icmp -m icmp --icmp-type 8 -j BAN

and do the same in this same chain:

-A BAN -p icmp -m icmp --icmp-type 8 -m recent --name ping --set
-A BAN -m recent --name ping --hitcount 3 --rcheck --seconds 60 -j DROP

... this only blocks the ICMP traffic, but not the other traffic from the IP address(es). Why is this?

Answer 1

The -j DROP rule affects only traffic that has been redirected into the BAN chain — and that’s only the ping traffic.  Other traffic from the blacklisted IP address(es) never gets into the BAN chain, and so it never hits the -j DROP rule.