Change:
Network access works well on a new instance booted from the stable AMIs listed on the website, but after running and rebooting the instance, it is broken. More specifically, the host can no longer send packets with an MSS larger than 3836. two EC2 instances from one of the 18.03 AMIs in the same VPC one of them latest stable with and reboot the security group to allow internal VPC communication on the host without the updates and on the updated one As I was writing this, I dug a bit deeper and found out that this is a bug introduced in the 4.14.37 release of the kernel. It is fixed in master (commit and possibly .) Applying those patches to the 4.14.51 kernel in stable fixes this issue for me.
Fix is now backported to 18.03.

Discussion:
}; }; <ins> # https://github.com/NixOS/nixpkgs/issues/42755 xen-netfront_fix_mismatched_rtnl_unlock = rec { name = "xen-netfront_fix_mismatched_rtnl_unlock"; patch = fetchpatch { name = name + ".patch"; url = https://github.com/torvalds/linux/commit/cb257783c2927b73614b20f915a91ff78aa6f3e8.patch; sha256 = "0xhblx2j8wi3kpnfpgjjwlcwdry97ji2aaq54r3zirk5g5p72zs8"; }; }; # https://github.com/NixOS/nixpkgs/issues/42755 xen-netfront_update_features_after_registering_netdev = rec { name = "xen-netfront_update_features_after_registering_netdev"; patch = fetchpatch { name = name + ".patch"; url = https://github.com/torvalds/linux/commit/45c8184c1bed1ca8a7f02918552063a00b909bf5.patch; sha256 = "1l8xq02rd7vakxg52xm9g4zng0ald866rpgm8kjlh88mwwyjkrwv"; }; }; </ins> }

[ kernelPatches.bridge_stp_helper kernelPatches.cpu-cgroup-v2."4.4" kernelPatches.modinst_arg_list_too_long <ins> # https://github.com/NixOS/nixpkgs/issues/42755 # Remove these xen-netfront patches once they're included in # upstream! Fixes https://github.com/NixOS/nixpkgs/issues/42755 kernelPatches.xen-netfront_fix_mismatched_rtnl_unlock kernelPatches.xen-netfront_update_features_after_registering_netdev </ins> ]; };

[ kernelPatches.bridge_stp_helper kernelPatches.cpu-cgroup-v2."4.9" kernelPatches.modinst_arg_list_too_long <ins> # https://github.com/NixOS/nixpkgs/issues/42755 # Remove these xen-netfront patches once they're included in # upstream! Fixes https://github.com/NixOS/nixpkgs/issues/42755 kernelPatches.xen-netfront_fix_mismatched_rtnl_unlock kernelPatches.xen-netfront_update_features_after_registering_netdev </ins> ]; };

# when adding a new linux version kernelPatches.cpu-cgroup-v2."4.11" kernelPatches.modinst_arg_list_too_long <ins> # https://github.com/NixOS/nixpkgs/issues/42755 # Remove these xen-netfront patches once they're included in # upstream! Fixes https://github.com/NixOS/nixpkgs/issues/42755 kernelPatches.xen-netfront_fix_mismatched_rtnl_unlock kernelPatches.xen-netfront_update_features_after_registering_netdev </ins> ]; };

# kernelPatches.cpu-cgroup-v2."4.11" kernelPatches.modinst_arg_list_too_long kernelPatches.bcm2835_mmal_v4l2_camera_driver # Only needed for 4.16! <ins> # https://github.com/NixOS/nixpkgs/issues/42755 # Remove these xen-netfront patches once they're included in # upstream! Fixes https://github.com/NixOS/nixpkgs/issues/42755 kernelPatches.xen-netfront_fix_mismatched_rtnl_unlock kernelPatches.xen-netfront_update_features_after_registering_netdev </ins> ]; };