diff --git a/pkg/util/openstack/image.go b/pkg/util/openstack/image.go
index 1162cd045f..f040d7b687 100644
--- a/pkg/util/openstack/image.go
+++ b/pkg/util/openstack/image.go
@@ -234,9 +234,10 @@ func (region *SRegion) GetImageByName(name string) (*SImage, error) {
 
 func (region *SRegion) CreateImage(imageName string) (*SImage, error) {
 	params := map[string]string{
-		"container_format": "bare",
-		"disk_format":      "vmdk",
-		"name":             imageName,
+		"container_format":    "bare",
+		"disk_format":         "vmdk",
+		"name":                imageName,
+		"hw_qemu_guest_agent": "yes",
 	}
 
 	_, resp, err := region.Post("image", "/v2/images", "", jsonutils.Marshal(params))
diff --git a/pkg/util/openstack/securitygroup.go b/pkg/util/openstack/securitygroup.go
index dc42070d11..683b58d160 100644
--- a/pkg/util/openstack/securitygroup.go
+++ b/pkg/util/openstack/securitygroup.go
@@ -190,6 +190,9 @@ func (secgroup *SSecurityGroup) GetRules() ([]secrules.SecurityRule, error) {
 		subRules := rule.toRules()
 		rules = append(rules, subRules...)
 	}
+	defaultDenyRule := secrules.MustParseSecurityRule("out:deny any")
+	defaultDenyRule.Priority = 1
+	rules = append(rules, *defaultDenyRule)
 	return rules, nil
 }
 
@@ -260,6 +263,24 @@ func (region *SRegion) syncSecgroupRules(secgroupId string, rules []secrules.Sec
 		return "", err
 	}
 
+	// OpenStack仅支持allow规则添加，需要将规则全转换为allow rules
+	inRules, outRules := secrules.SecurityRuleSet{}, secrules.SecurityRuleSet{}
+	for i := 0; i < len(rules); i++ {
+		if rules[i].Direction == secrules.DIR_IN {
+			inRules = append(inRules, rules[i])
+		} else {
+			outRules = append(outRules, rules[i])
+		}
+	}
+
+	// OpenStack Out方向默认是禁止所有流量，需要给本地安全组规则加一条优先级最低的allow any规则，和OpenStack规则语义保持一致
+	defaultAllow := secrules.MustParseSecurityRule("out:allow any")
+	defaultAllow.Priority = 0
+	outRules = append(outRules, *defaultAllow)
+
+	rules = inRules.AllowList()
+	rules = append(rules, outRules.AllowList()...)
+
 	sort.Sort(secrules.SecurityRuleSet(rules))
 	sort.Sort(SecurigyGroupRuleSet(secgroup.SecurityGroupRules))