VPC Traffic Control with AWS Network Firewall - Stateful Rules and Domain Filtering
Control VPC traffic with stateful/stateless rules and domain filtering. Learn how to leverage Suricata-compatible rules and managed rule groups.
Network Firewall's Role and How It Differs from Security Groups
Network Firewall is a managed firewall service that inspects traffic inline within a VPC. While security groups are limited to L3/L4 filtering at the ENI level, Network Firewall provides L7 application protocol inspection, domain-based filtering, and IDS/IPS signature matching. It is deployed in a dedicated firewall subnet, with route tables directing traffic through the firewall endpoint. By placing it between the internet gateway and workload subnets, you can inspect both inbound and outbound traffic.
Rule Design and Domain Filtering
Stateless rules match on 5-tuples (source/destination IP, source/destination port, protocol) and specify pass, drop, or forward to stateful rules. Stateful rules track connection state and allow writing L7 inspection rules in Suricata-compatible format. Domain list filtering inspects the HTTP Host header or TLS SNI (Server Name Indication) to perform filtering based on allow lists or deny lists. Controlling outbound traffic with an allow-list approach, permitting communication only to domains required for business operations, is effective for preventing data exfiltration.
Managed Rules and Operations
AWS Managed Rule Groups are rule sets containing known threat signatures that AWS automatically updates. They cover malware C2 communication patterns, known malicious domains, and common attack signatures. Firewall logs can be sent to CloudWatch Logs, S3, or Kinesis Data Firehose, with alert logs (traffic matching rules) and flow logs (all traffic) stored separately. Using Firewall Manager, you can apply unified firewall policies across all accounts in an Organizations setup, with policies automatically applied when new accounts or VPCs are created. For those who want to systematically learn about network security, related books (Amazon) can also be helpful.
Network Firewall Pricing
Network Firewall pricing consists of hourly charges for firewall endpoints and data processing volume. An endpoint costs approximately $0.395/hour per AZ (about $284/month), and multi-AZ configurations incur costs for each AZ. Data processing costs approximately $0.065 per GB. For a 2-AZ configuration processing 1 TB of traffic per month, the monthly cost is approximately $633 (endpoints $568 + data processing $65). Optimize costs by using security groups and NACLs for filtering that does not require Network Firewall, and routing only traffic that needs L7 inspection through Network Firewall.
Summary
Network Firewall is a managed firewall that provides L7-level traffic inspection beyond what security groups can handle. It delivers advanced threat protection through domain filtering and Suricata-compatible rules, and Firewall Manager enables unified policy enforcement across the entire organization.