Question

Firewall settings for droplet-to-space connectivity

Posted on April 23, 2023
DigitalOcean Cloud Firewalls DigitalOcean Spaces DigitalOcean Droplets
Asked by Tom Ghali

I have a public network droplet that puts objects to a space in nyc3.digitaloceanspaces.com. When the droplet is added to a DO firewall, the put operation throws an unknown host exception. When the firewall is removed, it succeeds.

The firewall’s inbound and outbound rules are identical, allowing SSH, HTTP, and HTTPS over the standard ports for all IPV4, IPV6.

Am I missing a setting, or is there some other issue? Many thanks in advance!

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Bobby Iliev

Site Moderator

• April 24, 2023

Accepted Answer

Hi there,

As you have already allowed ports 443 and 80 for both incoming and outbound connections, what I could suggest here is also allowing port 53 as well.

As the “unknown host exception” error indicates that there might be an issue with the DNS resolution, to make sure that the Droplet can properly resolve the hostname for the Spaces endpoint when the firewall is active, that’s why you might need to allow outbound traffic on port 53 for both TCP and UDP to enable DNS resolution.

Let me know how it goes!

Best,

Bobby