Getting started with a Classic AWS Network Firewall policy
This tutorial walks you through creating a Classic AWS Network Firewall firewall using the AWS Management Console. A Classic policy uses stateless rule groups and stateful rule groups. You create a stateless rule group and a stateful rule group, combine them in a Classic firewall policy, create a firewall, and route your VPC traffic through the firewall endpoint. For a tutorial that uses a Next Generation policy instead, see Getting started with a Next Generation policy. For the differences between the two policy types, see AWS Network Firewall firewall policy versions.
This tutorial uses the same VPC prerequisites as described in Before you begin.
Topics
Step 1: Create rule groups
Rule groups are reusable collections of network filtering rules that you use to configure firewall behavior. In this step, you create a stateless rule group and a stateful rule group. For information about rule groups, see Managing your rule groups.
To name a stateless rule group and choose its type
-
Sign in to the AWS Management Console and open the Amazon VPC console at https://console.aws.amazon.com/vpc/
. In the navigation pane, under Network Firewall, choose Network Firewall rule groups, and then choose Create.
-
On the Describe rule group page, enter a Name for the rule group, and optionally a description. You use the name to identify the rule group when you add it to your firewall policy later in the tutorial. You can't change the name after you create the rule group. Choose Next.
-
On the Choose rule group type page, for Rule group version, select Classic. For the rule group type, select Stateless rule group. Choose Next.
After you select the rule group type, configure the rule and set the capacity to finish creating the stateless rule group.
To configure rules and create the stateless rule group
-
On the Configure rules page, enter the rule specifications to create a stateless rule that blocks all packets coming from the source IP address CIDR range
10.0.0.0/24: set the priority to 10, leave the protocol at All, for the source select Custom and enter10.0.0.0/24, leave the source port at Any, for the destination leave Any IPv4 address selected, and for Rule action select Drop. Choose Add rule to add your rule to the Rules list. -
On the same page, under Capacity sizing, leave Allow room to grow selected (the recommended option), or select Match current rules or Custom capacity (a value from 1 to 30,000). You can't change the capacity after you create the rule group. Choose Next.
-
On the Review and create page, review the settings for the rule group, then choose Create.
Your new rule group is added to the list in the Rule groups page.
To create a stateful rule group
-
From the Rule groups page, choose Create.
-
On the Describe rule group page, enter a Name for the stateful rule group, and optionally a description. Choose Next.
-
On the Choose rule group type page, for Rule group version, select Classic. For the rule group type, select Stateful rule group. For Rule group format, select Text rule builder. For Rule evaluation order, leave Strict order selected (the recommended option). Choose Next.
-
On the Rule group variables page, choose Next to accept the defaults.
-
On the Configure rules page, under the Suricata compatible rule string, copy and paste the following rule. This rule drops TLS traffic for a specific target domain:
drop tls $HOME_NET any -> $EXTERNAL_NET any (ssl_state:client_hello; tls.sni; content:"evil.com"; startswith; nocase; endswith; msg:"matching TLS denylisted FQDNs"; priority:1; flow:to_server, established; sid:1; rev:1;) -
On the same page, under Capacity sizing, leave Allow room to grow selected (the recommended option). You can't change the capacity after you create the rule group. Choose Next.
-
On the Review and create page, review the rule group, then choose Create.
Your stateless rule group and your stateful rule group are listed in the Rule groups page. You can now use these rule groups in your firewall policies.
Step 2: Create a firewall policy
Firewall policies use rule groups and other settings to define the traffic filtering behavior for a firewall. In this procedure, you create a Classic policy using the rule groups that you created in the previous step. For information about firewall policies, see Firewall policies in AWS Network Firewall.
To configure a firewall policy
-
Sign in to the AWS Management Console and open the Amazon VPC console at https://console.aws.amazon.com/vpc/
. In the navigation pane, under Network Firewall, choose Firewall policies, and then choose Create firewall policy. On the Firewall policy details page, for Policy version select Classic (for information about the policy types, see AWS Network Firewall firewall policy versions), and enter the name that you want to use for the firewall policy. You use the name to identify the policy when you associate it with your firewall later in the tutorial, and you can't change it after you create the policy. Then choose Next.
-
On the Traffic inspection page, leave the settings unset for this tutorial, and then choose Next.
-
On the Add rule groups page, in the Stateful rule evaluation order and default actions section leave the default rule evaluation order for this tutorial; in the Stateful rule group section choose Add stateful rule groups, select your stateful rule group, and choose Add rule groups; in the Stateless default actions section, under Fragmented packets select Use the same actions for all packets and for Rule action select Forward to stateful rule groups so that traffic your stateless rule group doesn't block is inspected by the stateful engine (Network Firewall only manages UDP packet fragments and silently drops packet fragments for other protocols); and in the Stateless rule group section choose Add stateless rule groups, select your stateless rule group, and choose Add rule groups. Then choose Next.
-
On the Network and encryption page, choose Next to accept the defaults for this tutorial.
-
On the Review and create page, review your settings (choose Edit for any area to return to the corresponding page in the wizard), and then choose Create firewall policy.
Your new firewall policy is added to the list in the Firewall policies page. You can now use your firewall policy in your firewalls.
Step 3: Create a firewall
Firewalls associate the traffic filtering behavior of a firewall policy with the primary VPC where you want to filter traffic. In this procedure, you create a firewall using the firewall policy that you created in the previous step. For information about firewalls, see Firewalls and firewall endpoints in AWS Network Firewall.
To start creating a firewall and set its attachment type
-
Sign in to the AWS Management Console and open the Amazon VPC console at https://console.aws.amazon.com/vpc/
. In the navigation pane, under Network Firewall, choose Firewalls, and then choose Create firewall.
On the Describe firewall page, for Name, enter the name that you want to use to identify this firewall. You can't change the name of a firewall after you create it. Choose Next.
On the Attachment type page, under Attachment Details, select VPC, select your VPC, and then select the Availability Zone, Subnet, and IP address type for the firewall subnet that you identified in Before you begin. Choose Next.
After you set the attachment type, configure the remaining settings, associate your firewall policy, and create the firewall.
To configure settings and create the firewall
On the Configure advanced settings page, the settings are optional. For this tutorial, choose Next to accept the defaults.
On the Associate firewall policy page, select Associate an existing firewall policy, then select the firewall policy that you created in the prior procedure. Choose Next.
(Optional) On the Add tags page, add any tags that you want, then choose Next.
On the Review and create page, review the firewall configuration, and then choose Create firewall.
Your new firewall is listed in the Firewalls page. You've configured the firewall's behavior with the firewall policy and rule groups, and your firewall has an endpoint that's running in your VPC, ready to filter network traffic.
Network Firewall supports up to 100 Gbps of network traffic per firewall endpoint. If you require more traffic bandwidth, you can split your resources into subnets and create a Network Firewall in each subnet.
The next step is to route the VPC's network traffic through the firewall endpoint. You insert it into the traffic flow between the internet gateway and your customer subnet.
Step 4: Update your Amazon VPC route tables
After you create your firewall, you insert its firewall endpoint into your Amazon Virtual Private Cloud network traffic flow, in between your internet gateway and your customer subnet. You create routing for the firewall endpoint so that it forwards traffic between the internet gateway and your subnet. Then, you update the route tables for your internet gateway and your subnet, to send traffic to the firewall endpoint instead of to each other.
This procedure covers the high-level steps for route table management. For information about managing route tables for your VPC, see Route tables in the Amazon Virtual Private Cloud User Guide.
To modify your route tables to insert a firewall endpoint between your internet gateway and your subnet
-
Review your routing for the internet gateway and for your customer subnet, to determine the components used to route traffic between the two.
Record the current settings. You use them to reverse your changes at the end of the tutorial.
-
The internet gateway's route table typically has an entry with a destination set to your customer subnet's CIDR block and a target of
local. -
The subnet's route table typically has an entry with a destination set to
0.0.0.0/0and a target set to the internet gateway ID.
-
-
Create a route table configuration for the firewall endpoint with the following two routes:
-
An entry that matches the internet gateway's route specification for traffic going to the customer subnet's CIDR block.
-
An entry that matches the subnet's route specification for traffic going to the internet gateway.
The firewall endpoint is now ready to filter and forward traffic between the internet gateway and the customer subnet. The endpoint only forwards traffic to its intended destination if it passes the inspection criteria that you defined in the rule groups and firewall policy.
-
-
Update the internet gateway's routing to modify the entry with a destination set to your customer subnet's CIDR block. Change the target to the firewall endpoint ID.
-
Update the customer subnet routing to modify the entry with a destination set to the internet gateway ID. Change the target to the firewall endpoint ID.
The firewall endpoint is now filtering all traffic between your internet gateway and customer subnet.
Step 5: Remove the firewall and clean up your resources
You've now successfully completed the tutorial. To remove the firewall endpoint from your VPC and prevent your account from accruing AWS Network Firewall charges for the tutorial resources, revert your route table changes and clean up the Network Firewall resources that you created.
To modify your route tables to remove the firewall
-
Return the internet gateway and subnet route tables to the configurations they had at the start of the prior procedure. This stops traffic from routing to the firewall endpoint.
-
Remove the route table configuration for the firewall endpoint.
To delete the firewall
Sign in to the AWS Management Console and open the Amazon VPC console at https://console.aws.amazon.com/vpc/
. -
In the navigation pane, under Network Firewall, choose Firewalls.
-
In the Firewalls page, select the firewall that you created for the tutorial.
-
Choose Actions, then choose Delete, and then confirm your request.
To avoid incurring further AWS Network Firewall charges, after you delete the firewall, also delete the firewall policy and the rule groups that you created for the tutorial.
To delete the firewall policy and rule groups
-
In the navigation pane, under Network Firewall, choose Firewall policies.
-
In the Firewall policies page, select the firewall policy that you created for the tutorial.
-
Choose Delete, and confirm your request.
-
In the navigation pane, under Network Firewall, choose Network Firewall rule groups.
-
In the Rule group page, select the name of the rule groups that you created for the tutorial, and then choose Delete.
You've successfully removed the firewall from your VPC traffic flow and removed all of the Network Firewall resources that you created for this tutorial.
