AWS Network Firewall

AWS Network Firewall is a managed service that provides network filtering and threat prevention for your VPC. It inspects traffic at the network and application layers, allowing you to define rules that control inbound and outbound traffic. The primary problem it solves is the need for a scalable, high-availability firewall that integrates deeply with AWS networking. Without it, customers had to deploy third-party firewall appliances (e.g., from Palo Alto or Fortinet) using EC2 instances, which required manual scaling, patching, and failover management. Network Firewall is fully managed by AWS, meaning it automatically scales, is highly available (deployed across multiple Availability Zones), and requires no underlying infrastructure management.

AWS Network Firewall operates by inspecting traffic that is routed through a firewall endpoint in your VPC. Here's the mechanism step by step:

1. Firewall Endpoint: You create a firewall endpoint in a VPC subnet. This endpoint is an elastic network interface (ENI) that acts as the inspection point. 2. Route Tables: You configure VPC route tables to direct traffic to the firewall endpoint. For example, all outbound traffic from private subnets to the internet can be routed to the firewall ENI before reaching the internet gateway. Similarly, inbound traffic from the internet can be routed through the firewall before reaching application instances. 3. Rule Groups: You define rule groups that contain firewall rules. Each rule can be either stateful or stateless: - Stateless rules: Simple allow/deny based on 5-tuple (source IP, destination IP, source port, destination port, protocol). These are processed first, in order, and can be used for fast filtering. - Stateful rules: Inspect traffic in the context of a connection (e.g., TCP session). They support advanced features like intrusion prevention (IPS), domain filtering, and protocol detection. Stateful rules are processed after stateless rules. 4. Traffic Evaluation: When a packet arrives, the firewall first checks stateless rules. If a stateless rule matches and allows or denies, the action is taken. If no stateless rule matches, the default stateless action (e.g., forward to stateful rules) is applied. Then, stateful rules are evaluated. Stateful rules can be configured with Suricata-compatible rules (an open-source IPS engine) for deep packet inspection. 5. Logging and Metrics: All traffic can be logged to Amazon S3, CloudWatch Logs, or Kinesis Data Firehose. Metrics are sent to CloudWatch for monitoring.

Traditional on-premises firewalls are physical appliances that sit at the network perimeter. They require manual configuration, hardware maintenance, and capacity planning. In the cloud, you can use:

AWS Network Firewall fills the gap between simple security groups/ACLs and full third-party appliances. It is ideal for customers who need network-layer filtering with IPS capabilities but want to avoid managing infrastructure.

To create a Network Firewall using AWS CLI:

aws network-firewall create-firewall \
    --firewall-name MyFirewall \
    --firewall-policy-arn arn:aws:network-firewall:us-east-1:123456789012:firewall-policy/MyFirewallPolicy \
    --vpc-id vpc-12345678 \
    --subnet-mappings SubnetId=subnet-12345678

CloudFormation snippet for a firewall:

Resources:
  MyFirewall:
    Type: AWS::NetworkFirewall::Firewall
    Properties:
      FirewallName: MyFirewall
      FirewallPolicyArn: !Ref MyFirewallPolicy
      VpcId: !Ref VPC
      SubnetMappings:

- SubnetId: !Ref Subnet

A mid-size e-commerce company hosts its web application on AWS and must comply with PCI DSS, which requires a firewall to protect cardholder data. They use AWS Network Firewall to inspect all inbound and outbound traffic. They deploy a firewall in a centralized inspection VPC (using VPC peering or Transit Gateway) to inspect traffic from multiple application VPCs. The firewall logs are sent to S3 for audit. They use managed threat prevention rules to block known malicious IPs and enable IPS to detect SQL injection attempts. Cost-wise, they pay for the firewall endpoint (approx $0.395/hour per AZ) and data processing ($0.065/GB). For high traffic (100 TB/month), data processing costs can be significant. They also use Firewall Manager to apply the same policy across all accounts. Misconfiguration: initially, they forgot to route traffic from the internet gateway to the firewall, allowing inbound traffic to bypass inspection. They fixed this by updating the internet gateway route table.

A large enterprise wants to block access to social media and malicious websites from their corporate VPC. They deploy AWS Network Firewall with a stateful domain filter rule group that blocks domains like 'facebook.com' and 'twitter.com'. They also enable Suricata rules to detect command-and-control traffic. The firewall is deployed in a shared services VPC, and all other VPCs route internet-bound traffic through it via Transit Gateway. They use CloudWatch alarms to monitor blocked traffic spikes. A common mistake: they initially used stateless rules to block IP ranges of social media sites, but IPs change frequently, so they switched to domain filtering. Cost: they pay for the firewall and data processing, but the cost is justified by reduced risk of data exfiltration.

A startup uses a single VPC with public and private subnets. They want basic network protection without managing a third-party appliance. They deploy Network Firewall with default settings and use AWS managed threat prevention rules. They route all outbound traffic from private subnets through the firewall. Because traffic is low (under 1 TB/month), costs are manageable (~$300/month for the firewall endpoint plus data processing). However, they made a mistake: they did not enable logging initially, so when an incident occurred, they had no logs to investigate. They quickly enabled S3 logging. They also learned that Network Firewall is not a web application firewall (WAF); for their web app, they added AWS WAF separately.