Skip to content

Commit 8ea75f1

Browse files
widowido
committed
CLOUDSTACK-9552: Allow egress TCP/53 implicitly in Basic Networking
Allow DNS queries over TCP when egress filtering is configured. When using DNSSEC more and more queries are done over TCP and this requires 53/TCP to be allowed. Signed-off-by: Wido den Hollander <wido@widodh.nl>
1 parent fcee71f commit 8ea75f1

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

‎scripts/vm/network/security_group.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -493,6 +493,7 @@ def default_network_rules(vm_name, vm_id, vm_ip, vm_mac, vif, brname, sec_ips):
493493
if vm_ip is not None:
494494
execute("iptables -A " + vmchain_default + " -m physdev --physdev-is-bridged --physdev-in " + vif + " -m set ! --set " + vmipsetName + " src -j DROP")
495495
execute("iptables -A " + vmchain_default + " -m physdev --physdev-is-bridged --physdev-in " + vif + " -m set --set " + vmipsetName + " src -p udp --dport 53 -j RETURN ")
496+
execute("iptables -A " + vmchain_default + " -m physdev --physdev-is-bridged --physdev-in " + vif + " -m set --set " + vmipsetName + " src -p tcp --dport 53 -j RETURN ")
496497
execute("iptables -A " + vmchain_default + " -m physdev --physdev-is-bridged --physdev-in " + vif + " -m set --set " + vmipsetName + " src -j " + vmchain_egress)
497498
execute("iptables -A " + vmchain_default + " -m physdev --physdev-is-bridged --physdev-out " + vif + " -j " + vmchain)
498499
execute("iptables -A " + vmchain + " -j DROP")

0 commit comments

Comments
 (0)