VPC Traffic Control with AWS Network Firewall - Stateful Rules and Domain Filtering
Control VPC traffic with stateful/stateless rules and domain filtering. Learn how to leverage Suricata-compatible rules and managed rule groups.
Network Firewall's Role and How It Differs from Security Groups
Network Firewall is a managed firewall service that inspects traffic inline within a VPC. While security groups are limited to L3/L4 filtering at the ENI level, Network Firewall provides L7 application protocol inspection, domain-based filtering, and IDS/IPS signature matching. It is deployed in a dedicated firewall subnet, with route tables directing traffic through the firewall endpoint. By placing it between the internet gateway and workload subnets, you can inspect both inbound and outbound traffic. Unlike on-premises next-generation firewalls from vendors such as Palo Alto Networks or Fortinet, Network Firewall eliminates hardware procurement and firmware management as a fully managed service.
Rule Design and Domain Filtering
Stateless rules match on 5-tuples (source/destination IP, source/destination port, protocol) and specify pass, drop, or forward to stateful rules. They are suited for high-speed processing of large traffic volumes. Stateful rules track connection state and support three formats: Suricata-compatible IPS rules, domain list rules, and 5-tuple rules. Domain list filtering inspects the HTTP Host header or TLS SNI (Server Name Indication) to perform filtering based on allow lists or deny lists. TLS SNI inspection enables domain filtering even for encrypted HTTPS traffic. Controlling outbound traffic with an allow-list approach, permitting communication only to domains required for business operations, limits data exfiltration.
Multi-Layer Defense Architecture with WAF
Combining Network Firewall with AWS WAF enables multi-layer defense from the network layer to the application layer. Network Firewall operates at the VPC subnet level and inspects traffic that passes through the firewall endpoint. WAF operates in front of CloudFront, ALB, and API Gateway, providing application-layer protection through SQL injection, XSS, and rate-based rules. A centralized firewall architecture using Transit Gateway aggregates traffic from multiple VPCs to a single Network Firewall endpoint, applying unified security policies.
Managed Rules and Organization-Wide Governance
AWS Managed Rule Groups are rule sets containing known threat signatures that AWS automatically updates. They cover malware C2 communication patterns, known malicious domains, and botnet communication patterns. Firewall Manager enables unified firewall policy enforcement across accounts in an Organizations setup. Manage both Network Firewall and WAF policies centrally to align the organization's security policies.
Log Analysis and Threat Intelligence Integration
Network Firewall can output alert logs and flow logs to S3, CloudWatch Logs, and Amazon Data Firehose. Alert logs record detailed information about traffic matching IPS rules, useful for security incident investigation. Flow logs record traffic metadata, enabling network visualization and anomaly detection. These logs can be aggregated in OpenSearch Service and visualized on dashboards for security monitoring. You can also integrate with GuardDuty threat detection findings to automatically add detected threat IP addresses to block lists. Lambda and EventBridge can automate the response from threat detection to blocking.
Network Firewall Pricing
Network Firewall pricing consists of hourly charges for firewall endpoints and data processing volume. Endpoint charges depend on the number of endpoints deployed and the hours they run. Use security groups and NACLs for filtering that does not require Network Firewall, and route only traffic that needs L7 inspection through Network Firewall to keep data processing volume down.
Summary
Network Firewall is a managed firewall that provides L7-level traffic inspection beyond what security groups can handle. It protects against threats with Suricata-compatible rules and domain filtering, and can be combined with WAF for multi-layer defense. Integration with GuardDuty findings can automate blocking, and Firewall Manager applies unified policies across the entire organization.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS Network Firewall official page
- Amazon VPC official page
- AWS Firewall Manager official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.