diff --git a/datadog-integration/modules/regional-stacks/data.tf b/datadog-integration/modules/regional-stacks/data.tf
index 5135d47d..7bd14520 100644
--- a/datadog-integration/modules/regional-stacks/data.tf
+++ b/datadog-integration/modules/regional-stacks/data.tf
@@ -35,3 +35,8 @@ data "oci_core_subnet" "provided_subnet" {
   count     = var.subnet_ocid != "" ? 1 : 0
   subnet_id = var.subnet_ocid
 }
+
+data "oci_core_vcn" "dd_vcn" {
+  count  = var.subnet_ocid == "" ? 1 : 0
+  vcn_id = module.vcn[0].vcn_id
+}
diff --git a/datadog-integration/modules/regional-stacks/main.tf b/datadog-integration/modules/regional-stacks/main.tf
index 41e2c79b..9ff830fa 100644
--- a/datadog-integration/modules/regional-stacks/main.tf
+++ b/datadog-integration/modules/regional-stacks/main.tf
@@ -40,7 +40,7 @@ module "vcn" {
   vcn_cidrs                = ["10.0.0.0/16"]
   vcn_dns_label            = "ddvcnmodule"
   vcn_name                 = local.vcn_name
-  lockdown_default_seclist = false
+  lockdown_default_seclist = true
 
   subnets = {
     private = {
@@ -56,6 +56,39 @@ module "vcn" {
   service_gateway_display_name = local.service_gateway
 }
 
+resource "oci_core_default_security_list" "dd_default" {
+  count                      = var.subnet_ocid == "" ? 1 : 0
+  manage_default_resource_id = data.oci_core_vcn.dd_vcn[0].default_security_list_id
+  freeform_tags              = var.tags
+
+  egress_security_rules {
+    destination      = "0.0.0.0/0"
+    protocol         = "all"
+    destination_type = "CIDR_BLOCK"
+  }
+
+  # ICMP type 3 code 4: path MTU discovery (from anywhere)
+  ingress_security_rules {
+    protocol    = "1"
+    source      = "0.0.0.0/0"
+    source_type = "CIDR_BLOCK"
+    icmp_options {
+      type = 3
+      code = 4
+    }
+  }
+
+  # ICMP type 3: destination unreachable (from within VCN)
+  ingress_security_rules {
+    protocol    = "1"
+    source      = "10.0.0.0/16"
+    source_type = "CIDR_BLOCK"
+    icmp_options {
+      type = 3
+    }
+  }
+}
+
 resource "oci_functions_application" "dd_function_app" {
   compartment_id = var.compartment_ocid
   display_name   = "dd-function-app"
diff --git a/datadog-terraform-onboarding/modules/regional-stacks/data.tf b/datadog-terraform-onboarding/modules/regional-stacks/data.tf
index 5135d47d..7bd14520 100644
--- a/datadog-terraform-onboarding/modules/regional-stacks/data.tf
+++ b/datadog-terraform-onboarding/modules/regional-stacks/data.tf
@@ -35,3 +35,8 @@ data "oci_core_subnet" "provided_subnet" {
   count     = var.subnet_ocid != "" ? 1 : 0
   subnet_id = var.subnet_ocid
 }
+
+data "oci_core_vcn" "dd_vcn" {
+  count  = var.subnet_ocid == "" ? 1 : 0
+  vcn_id = module.vcn[0].vcn_id
+}
diff --git a/datadog-terraform-onboarding/modules/regional-stacks/main.tf b/datadog-terraform-onboarding/modules/regional-stacks/main.tf
index d0c1c6da..b97c18b3 100644
--- a/datadog-terraform-onboarding/modules/regional-stacks/main.tf
+++ b/datadog-terraform-onboarding/modules/regional-stacks/main.tf
@@ -43,7 +43,7 @@ module "vcn" {
   vcn_cidrs                = ["10.0.0.0/16"]
   vcn_dns_label            = "ddvcnmodule"
   vcn_name                 = local.vcn_name
-  lockdown_default_seclist = false
+  lockdown_default_seclist = true
 
   subnets = {
     private = {
@@ -59,6 +59,39 @@ module "vcn" {
   service_gateway_display_name = local.service_gateway
 }
 
+resource "oci_core_default_security_list" "dd_default" {
+  count                      = var.subnet_ocid == "" ? 1 : 0
+  manage_default_resource_id = data.oci_core_vcn.dd_vcn[0].default_security_list_id
+  freeform_tags              = var.tags
+
+  egress_security_rules {
+    destination      = "0.0.0.0/0"
+    protocol         = "all"
+    destination_type = "CIDR_BLOCK"
+  }
+
+  # ICMP type 3 code 4: path MTU discovery (from anywhere)
+  ingress_security_rules {
+    protocol    = "1"
+    source      = "0.0.0.0/0"
+    source_type = "CIDR_BLOCK"
+    icmp_options {
+      type = 3
+      code = 4
+    }
+  }
+
+  # ICMP type 3: destination unreachable (from within VCN)
+  ingress_security_rules {
+    protocol    = "1"
+    source      = "10.0.0.0/16"
+    source_type = "CIDR_BLOCK"
+    icmp_options {
+      type = 3
+    }
+  }
+}
+
 resource "oci_functions_application" "dd_function_app" {
   compartment_id = var.compartment_ocid
   display_name   = "dd-function-app"