Adding a firewall exception, for every instance, to allow traffic with source 169.254.169.254, since this is the IP of the metadataserver, and windows instances will need this exception, due to the apipa implemention, requiring a specific route to 169.254.169.254 via de default gateway to make the metadataserver reachable at all. This in turn makes the metadataserver reply with 169.254.169.254 as SRC IP, instead of the DEFGW IP, requiring a firewall exception