Why Is Traffic Bypassing AWS Network Firewall? Common Causes and Solutions
A company's security team notices that a VPC flow log record shows an outbound connection from a private EC2 instance to an IP address in a restricted country. The security group allows outbound 0.0.0.0/0 for TCP 443. The network ACL allows outbound traffic to 0.0.0.0/0 on ephemeral ports. The company uses AWS Network Firewall with a firewall policy that has a stateful rule group that denies traffic to the restricted country. The flow log shows the traffic was accepted. What is the most likely cause?
Quick Answer
The answer is that the subnet’s route table does not have a route sending traffic to the AWS Network Firewall endpoint. This is the most likely cause of the traffic bypass because AWS Network Firewall’s stateful rule groups are only evaluated for traffic that is actually routed through the firewall endpoint; if the route table for the subnet containing the EC2 instance points to an internet gateway or a NAT gateway instead, the traffic never touches the firewall, and its deny rules are never applied. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of how VPC routing integrates with security services—a common trap is assuming that firewall policies apply to all VPC traffic automatically, when in fact explicit routing is required. Remember the memory tip: “No route, no firewall review”—if the packet’s path doesn’t include the firewall endpoint, stateful rules are invisible to that traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The subnet's route table does not have a route that sends traffic to the AWS Network Firewall endpoint.
AWS Network Firewall's stateful rules are only evaluated for traffic that is routed through the firewall endpoint. If the subnet's route table does not include a route directing traffic to the firewall endpoint, the traffic bypasses the firewall entirely, allowing the outbound connection even though the firewall policy denies it. Option A is incorrect because VPC Flow Logs capture all accepted and rejected traffic after security group and NACL evaluation. Option C is incorrect because the network ACL allows outbound traffic on ephemeral ports, so inbound return traffic is permitted by the default ephemeral port rule. Option D is incorrect because the security group explicitly allows outbound HTTPS (TCP 443) to 0.0.0.0/0, which is permissive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Flow Logs are not capturing all traffic.
Why it's wrong here
VPC Flow Logs capture all accepted and rejected traffic that enters or leaves the VPC.
- ✓
The subnet's route table does not have a route that sends traffic to the AWS Network Firewall endpoint.
Why this is correct
If the route table does not point to the firewall, traffic bypasses the firewall and the stateful rule is not evaluated.
- ✗
The network ACL inbound rule blocks the return traffic.
Why it's wrong here
The network ACL allows outbound traffic on ephemeral ports, and the return traffic would be allowed by the inbound rule for established connections.
- ✗
The security group outbound rule is not configured correctly.
Why it's wrong here
The security group allows outbound HTTPS to 0.0.0.0/0, so the rule is correct.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with multiple subnets. They have an AWS Network Firewall deployed in a firewall subnet. They want to inspect all outbound traffic from the VPC to the internet. Currently, the VPC route table has a default route (0.0.0.0/0) pointing to an internet gateway. What routing change is required to route outbound traffic through the firewall?
medium- A.Create a VPC Gateway Endpoint for the firewall service.
- B.Add a NAT gateway in a public subnet and route 0.0.0.0/0 to the NAT gateway, then point the NAT gateway to the firewall.
- ✓ C.Add a route in the subnet route tables that sends 0.0.0.0/0 traffic to the Network Firewall endpoint's elastic network interface.
- D.Add a transit gateway and attach the VPC and the internet gateway to it, then route traffic through the firewall.
Why C: To route traffic through AWS Network Firewall, you must add a route in the subnet route tables that sends 0.0.0.0/0 traffic to the firewall endpoint's elastic network interface (ENI). This forces outbound traffic to be inspected by the firewall before reaching the internet gateway. Option A is incorrect because a VPC Gateway Endpoint is used for private access to AWS services, not for routing traffic through a firewall. Option B is incorrect because a NAT gateway provides outbound connectivity but does not inspect traffic; adding another hop to the firewall would be redundant and not supported. Option D is incorrect because a transit gateway is used to connect multiple VPCs or on-premises networks, not to route traffic through a single firewall.
Variation 2. A company has a VPC with multiple subnets and uses AWS Network Firewall to inspect traffic. The security team notices that traffic to a specific IP (10.0.0.10) is being dropped unexpectedly. The firewall policy has a stateful rule group that allows all traffic. What is the MOST likely cause?
hard- A.The stateful rule group has an implicit deny for that IP
- B.AWS Shield Advanced is blocking the traffic
- ✓ C.The stateless default action is set to drop
- D.The subnet's route table does not have a route to the firewall endpoint
Why C: Network Firewall evaluates stateless rules first, and a stateless default drop action would drop traffic before stateful rules are considered. Option A is wrong because stateful rules allow all. Option B is wrong because route table directs traffic to firewall. Option D is wrong because AWS Shield is for DDoS protection.
Variation 3. A company uses AWS Network Firewall to inspect traffic. They notice that some traffic is bypassing the firewall. The VPC has a route table with a default route (0.0.0.0/0) pointing to the firewall endpoint. Which configuration could cause traffic to bypass the firewall?
hard- A.The route table has route propagation enabled
- B.The subnet is not associated with the route table
- C.The firewall endpoint is in a different Availability Zone
- ✓ D.The route table has a more specific route for the destination traffic
Why D: A more specific route (e.g., a /32 or /24 for the destination network) in the VPC route table will take precedence over the default route (0.0.0.0/0) that points to the firewall endpoint. This causes traffic destined for that specific network to bypass the firewall. Option A is incorrect because route propagation adds routes from VPN or Direct Connect but does not inherently cause bypass. Option B is incorrect because if the subnet is not associated with the firewall's route table, it uses the main route table, which could bypass the firewall, but the key issue here is the existence of a more specific route. Option C is incorrect because the firewall endpoint being in a different Availability Zone does not cause traffic to bypass; it can cause increased latency or other issues but not bypass.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.