Getting Started with AWS Network Firewall
Published: 2022-12-10 18:14:33


AWS Network Firewall is a managed service to provide network protections for all of your Amazon Virtual Private Clouds to make sure that your traffic is inspected, monitored, and logged. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3qkyjavybwnadia0gm47.png)



When AWS Network Firewall inspects a packet, it evaluates the packet against the rules in the policy's stateless rule groups first, using the stateless rules engine. Then, depending on that inspection and on other settings in the policy, it might evaluate the packets against the rules in the policy's stateful rule groups, using the stateful rules engine.

**VPC route table for firewall**
For Firewall we need a separate subnet, no other resource will be in this subnet

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s1ijl27ml23jly9zdqa9.png)

**Public Subnet RT**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8iurxfhwur7iqm57oaey.png)

**Private subnet rt**
Private subnet traffic will go to NAT gateway
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x23a7572pg609lpm88eb.png)

**Nat Subnet RT**
For Nat gateway we need a separate subnet traffic goes to Firewall endpoint

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uqg5a9bd44jy24gu2mn7.png)

**Firewall incoming RT**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wo00mrpzz2xyq1cbjcqm.png)

It's require edge association, no subnet association required.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8tpnynd7qxehh87svh7f.png)



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ix29499n3ypnl8epnk2b.png)

During stateless inspection, all individual packets in a flow are evaluated against all rule present in policy. Rules are processed in strict order based on the priority assigned to them, with lower numbered rules (e.g 10) taking precedence over higher numbered rules (for example, 100).

You are required to specify one of the following options:

Pass – Discontinue all inspection of the packet and permit it to go to its intended destination.
Drop – Discontinue all inspection of the packet and block it from going to its intended destination.
Forward to stateful rules – Discontinue stateless inspection of the packet and forward it to the stateful rule engine for inspection.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9za3lvf0twcg63j47rsq.png)

In the above rule group priority 1 rule having allow traffic from specific IP and deny all, however if we change the priority of 1 to 11 then , rule 10 will take precedence and all traffic will be dropped.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7lnqa1ihozvr17yh5uc0.png)



**Stateful rule inspection** works differently. The stateful rules engine processes rules in the order of action setting, with pass rules processed first, then drop, then alert. The engine stops processing if it finds the first match. E.g for approved domain list we can mention only certain domain can be accessed from the server restricting any other 3rd party repo access by developers.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cdz9ha5jlr8qswjdhout.png)

The firewall also takes into consideration the order that the rules appear in the rule group, and the priority assigned to the 
rule, if any.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n8sykgzz405b23qmtbsi.png)


For example, a pass rule with a priority of 1 will be processed prior to a pass rule with a priority of 2. However, a drop rule with a priority of 1 will always be processed after all pass rules have been evaluated, including those with a lower priority.



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ikbhqft9uya4n3t1auf7.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/w15dyh54h1kxpreyglya.png)


We can see in CloudWatch logs, traffic is blocked and captured in alert events.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ww698u2oax9njecemmzj.png)