Network Firewall, stateful rules engine allows traffic to pass by default, while the security groups default is to deny traffic

0

How does the default 'pass' behavior with AWS Network Firewall interact with the default 'deny' for AWS Security Groups? Such as it sounds like the Network Firewall and the Security Group operates on different levels, the traffic first hitting the Network Firewall, being allowed, and then hitting the Security Group. The traffic would still independently need to be vetted by the Network Firewall stateful rules and also on the allow list for the Security Group before it could get through, correct?

3 Answers
1

Your understanding is correct but order is wrong. First Traffic will hit Security Group. Once permitted in Security group. It will take action as per Network Firewall rules.

answered 2 months ago
0

Yes, you're correct. Traffic first passes through the AWS Network Firewall, which by default allows traffic unless explicitly denied by its stateful rules. Then, it encounters the AWS Security Groups, which by default deny all inbound traffic unless explicitly allowed. For traffic to successfully reach its destination, it must be permitted by both the Network Firewall and the Security Group rules. This layered security ensures that traffic is vetted both at the network level by the Network Firewall and at the instance level by the Security Groups before being allowed through.

If this has answered your question or was helpful, accepting the answer would be greatly appreciated. Thank you!

profile picture
EXPERT
answered 2 months ago
0

Network firewall, Security groups, NACLs operate at different layers and take decision independently to each other. For defense in depth you can make use of all these to safeguard your environment. The below blog has diagrams that shows how traffic flows via AWS Network Firewall.

https://aws.amazon.com/blogs/security/tls-inspection-configuration-for-encrypted-traffic-and-aws-network-firewall/

profile pictureAWS
EXPERT
answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions