AWS Network Firewall
A managed network firewall service that performs stateful inspection of VPC traffic for intrusion prevention and domain filtering
Overview
AWS Network Firewall is a managed firewall service that provides fine-grained control over network traffic within VPCs. It delivers advanced traffic inspection capabilities (stateful inspection, intrusion detection/prevention, domain-based filtering, TLS inspection) that security groups and NACLs cannot address. It uses a Suricata-compatible rule engine, allowing most Suricata rules to be used without modification. Combined with Transit Gateway or Gateway Load Balancer, it can operate as a centralized firewall for multi-VPC environments.
Two-Tier Architecture - Stateless and Stateful Rules
Network Firewall rules consist of two types that work in sequence. Stateless rule groups evaluate each packet independently based on IP addresses, ports, and protocols, operating similarly to NACLs. They process traffic first and can pass, drop, or forward packets to stateful rule groups for deeper inspection. Stateful rule groups track connection state and support three rule formats: 5-tuple rules for basic allow/deny decisions, domain list rules for FQDN-based filtering, and Suricata-compatible IPS rules for advanced threat detection. In practice, one approach is a two-tier design: use stateless rules to drop obviously unwanted traffic (known malicious IP ranges, invalid protocols) at high speed, then inspect remaining traffic in detail with stateful rules. The stateless engine prioritizes speed of evaluation, while the stateful engine supports more complex rules.
Domain Filtering and TLS Inspection
Domain list rules can allow HTTP/HTTPS traffic only to specific domains. Example uses include restricting outbound communication to approved external APIs, software update servers, or SaaS endpoints while blocking everything else. For HTTPS traffic, the firewall can inspect the SNI (Server Name Indication) field without decrypting the traffic, enabling domain-based filtering without the overhead of full TLS inspection. When deeper inspection of outbound traffic is required, TLS inspection decrypts, inspects, and re-encrypts traffic using certificates managed through ACM. According to the developer guide, Network Firewall stateful rules are Suricata compatible and most Suricata rules work without modification, although some Suricata features, such as Lua scripting and thresholding, are not supported. Azure Firewall also offers FQDN filtering, and Microsoft's documentation lists TLS inspection and IDPS among the features of the Azure Firewall Premium SKU (as of October 2026).
Centralized Inspection VPC and Organization-Wide Deployment with Firewall Manager
One deployment pattern for Network Firewall is a centralized inspection VPC. Transit Gateway routing aggregates all internet-bound traffic from every VPC through the inspection VPC, where Network Firewall inspects it centrally. This eliminates the need to deploy individual firewalls in each VPC and consolidates rule management into a single location. When combined with Firewall Manager, firewall policies can be applied to an entire organization in AWS Organizations or to a selected subset of accounts and VPCs, and in the distributed management model Firewall Manager creates a firewall and deploys firewall endpoints for each account and VPC within the policy scope. A cost consideration is that firewall endpoints must be created per Availability Zone - in a 3-AZ configuration, you incur fixed hourly charges for three endpoints plus pay-as-you-go traffic processing fees. The developer guide also notes that using a firewall endpoint in one Availability Zone to filter traffic from another zone can incur cross-zone traffic charges.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon VPC official page
- AWS WAF official page
- AWS Transit Gateway official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.