AWS Network Firewall
AWS Network Firewall is a managed, stateful network firewall and intrusion detection and prevention service for a VPC. AWS runs the underlying infrastructure and scales it; the customer defines the rules and the routing.
Where it sits
Section titled “Where it sits”Network Firewall creates firewall endpoints in dedicated subnets inside the VPC. Traffic is not intercepted automatically — VPC route tables are edited to steer it through the endpoints, which then sit between the protected subnets and everything outside the VPC. A firewall subnet is reserved for the endpoint and used for nothing else, because an endpoint cannot filter traffic entering or leaving its own subnet.
By default the firewall runs in source-preservation mode: traffic arrives from the VPC endpoint, is inspected, and is sent back through the endpoint to its destination with the original source and destination addresses intact.
What it filters
Section titled “What it filters”- Traffic to and from an internet gateway
- Traffic to and from a NAT gateway
- Traffic over VPN or AWS Direct Connect
- East-west traffic between VPCs, typically through a Transit Gateway
Network Firewall uses Suricata, the open-source IPS engine, for stateful inspection and accepts Suricata-compatible rules. Two rule group types exist:
- Stateless rules inspect a single packet on its own — a 5-tuple match, with no knowledge of the flow it belongs to.
- Stateful rules inspect packets in the context of their flow, which is what makes protocol detection, domain filtering and intrusion prevention possible.
Typical uses:
- Allow egress only to known domains or IP endpoints, such as Amazon S3
- Block outbound traffic to domains on a threat list
- Deep packet inspection of traffic entering or leaving the VPC
- Filter a protocol such as HTTPS by protocol detection rather than by port number
Multi-account management
Section titled “Multi-account management”AWS Firewall Manager can configure and manage Network Firewall across every account in an AWS Organizations organisation from one place, which is the practical way to run it beyond a couple of accounts. See AWS Firewall Manager.