You can specify which IP addresses, protocols, and port numbers are allowed or denied access to your VPC, and you can use security groups to further fine-tune your firewall rules.ĪWS Network Firewall includes several features that make it easy to set up and maintain firewall rules. It does this by allowing you to create and manage firewall rules that control inbound and outbound traffic to your VPC. It is a fully managed service that is available on a pay-as-you-go basis, so you only pay for what you use.ĪWS Network Firewall is designed to help protect your VPC and the resources within it from unauthorized access over the internet. It is based on the open-source firewall software, Vyatta, and is designed to be highly scalable and resilient. Pass tls $HOME_NET any -> $EXTERNAL_NET 443 (tls.AWS Network Firewall is a managed network security service that provides inbound and outbound traffic filtering for Amazon Virtual Private Clouds (VPCs).

Pass http $HOME_NET any -> $EXTERNAL_NET 80 (http.host dotprefix content:'.' endswith msg:'Allowed HTTP domain' sid:3 rev:1 ) Pass tls $HOME_NET any -> $EXTERNAL_NET 443 (tls.sni content:'' startswith nocase endswith msg:'matching TLS allowlisted FQDNs' sid:2 rev:1 ) Pass http $HOME_NET any -> $EXTERNAL_NET 80 (http.host dotprefix content:'.' endswith msg:'Allowed HTTP domain' sid:892120 rev:1 ) My preference is the strict firewall type as it allows for easier mixing of protocol types when creating the required suricata flow rules.Īn example of a working strict suricata stateful rules permitting the explicit domains: I have now tried both methods for both TLS and plain HTTP traffic using the sample rules provided here:

There are effectively two different ways to provision a firewall, default or strict. I started from scratch and followed the following design guide to adjust the routing setup to match best practice (I previously had the NAT gateway as next hop for the firewall subnet): With more playing around last night and this morning I'm in a better place.

Aws network firewall