Wido den Hollander created CLOUDSTACK-9552: ----------------------------------------------
Summary: KVM Security Groups do now allow DNS over TCP egress Key: CLOUDSTACK-9552 URL: https://issues.apache.org/jira/browse/CLOUDSTACK-9552 Project: CloudStack Issue Type: Bug Security Level: Public (Anyone can view this level - this is the default.) Components: KVM Affects Versions: 4.9.0, 4.8.0 Environment: KVM Basic Networking Reporter: Wido den Hollander Assignee: Wido den Hollander Fix For: Future When egress filtering is configured all outbound traffic is blocked unless configured otherwise. With the exception that UDP/53 DNS is allowed implicitly by the Security Groups. Many DNS responses are larger then 4k, with DNSSEC for example and require TCP to be allowed. The Security Groups should also allow TCP/53 when egress filtering is configured. -- This message was sent by Atlassian JIRA (v6.3.4#6332)