traffic-ats-stretch.traffic.eqiad.wmflabs (172.16.2.180/21) cannot open TCP connections to deployment-mediawiki-09.deployment-prep.eqiad.wmflabs (10.68.17.159/21) on port 80.
The latter host has a default INPUT firewall policy of DROP, but explicitly allows TCP connections to port 80 for 172.16.0.0/21.
0 0 ACCEPT tcp -- * * 172.16.0.0/21 0.0.0.0/0 tcp dpt:80
ICMP traffic flows regularly between the two hosts.
The problem was not reproducible up to at least 2018-10-11.