AWS Cloud Firewalls: Network Firewall, DNS Firewall, Firewall Manager and WAF

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. Everyday example

Emily's bank has three doors: the street gate (edge WAF + Shield on CloudFront), the building lobby metal detector (AWS Network Firewall in an inspection VPC), apartment locks (Security Groups + host FW), and a "do not dial these phone numbers" list (DNS Firewall). Firewall Manager is the corporate policy that says every branch must install the same lobby detector.

2. Map of AWS firewall-ish controls

3. SG vs NACL — brief only

What is it?

Security Groups are stateful and attach to ENIs. NACLs are stateless and attach to subnets. Allow/deny behaviour, rule numbers, and the 3-tier lab live entirely in Security Group vs NACL. Here we only say: design SG first for instance policy; use NACL sparingly for subnet guardrails.

4. AWS Network Firewall

Why do we need this?

You need central inspection for traffic that SG alone cannot express well: domain allow-lists on HTTPS (via Suricata), east-west controls between VPCs, explicit deny lists with alert logs, IPS-style signatures.

Stateless rule groups

Like a fast packet filter: 5-tuple (src/dest IP, port, protocol) with pass/drop/forward. Evaluated first. Use for coarse "drop this bogon range" before stateful engines spend CPU.

Stateful rule groups

Suricata-compatible rules and domain lists. Actions include alert, drop, pass. Example domain allow-list for egress: only *.amazonaws.com and your partner APIs leave the VPC.

# Conceptual Suricata-style rule (managed in Network Firewall rule group)
# drop http $HOME_NET any -> $EXTERNAL_NET any (http.host; content:"evil.example"; sid:1000001; rev:1;)
# Domain list rule group: allow-list mode with .example.com and .amazonaws.com

Inspection VPC pattern

Spoke VPCs send traffic to a central inspection VPC via Transit Gateway. Network Firewall endpoints sit in inspection subnets. Return path must be symmetric or state breaks. This is the pattern Emily uses for 40 app VPCs.

5. Route 53 Resolver DNS Firewall

Filters DNS queries from VPCs through Resolver. Domain lists (AWS managed threat lists or your own) with allow/block/alert actions. Stops malware call-homes even when HTTPS is encrypted — because the name lookup still happens.

• Block known malicious domains org-wide
• Alert on newly seen domains for SOC
• Pair with Network Firewall domain TLS rules for defense in depth

6. AWS Firewall Manager

Organisation-level policy: require a WAF rule group on every CloudFront/ALB, require Network Firewall in every VPC, require DNS Firewall rule groups, or SG audit rules. Prevents one account from "forgetting" CRS. Used in the DDoS-resilient architecture project.

7. Where WAF fits

WAF = Layer-7 HTTP on CloudFront, ALB, API Gateway, AppSync, Cognito. It does not replace Network Firewall for non-HTTP or east-west VPC flows. Deep: WAF explained, WAF hands-on, survey CloudFront+WAF.

8. Multi-industry snapshots

• Bank (Emily, Toronto): inspection VPC + Suricata drop sid list; DNS Firewall AWS managed list; FMS WAF baseline.
• Hospital (Adaeze): Network Firewall deny to gambling/social on clinical VPC egress; WAF on patient portal only.
• D2C (Lucas): CloudFront WAF edge; light Network Firewall on partner VPC peering path.
• SaaS (Vikram, Pune): FMS to force SG SSH≠0.0.0.0/0 across 12 accounts.

9. Lab: Network Firewall + DNS Firewall sketch

Use a dedicated lab account. Budget alert first. Region ap-south-1 unless blocked.

How to do it (step by step)

1. Create a small VPC with public + firewall + private subnets (or use Network Firewall getting-started wizard).
2. Create Network Firewall with a stateful domain allow-list (your test domain only) for egress from private subnet.
3. Route private→firewall endpoint→IGW/NAT carefully; document the route table IDs.
4. From a private instance: curl allowed domain (ok) and a random domain (blocked/timeout).
5. Create a Resolver DNS Firewall rule group blocking a test domain; associate to VPC.
6. nslookup blocked domain → NXDOMAIN/blocked per config; allowed domain resolves.
7. Optional: in Firewall Manager (org admin), sketch a policy — do not attach to prod OUs in lab.

# Illustrative CLI fragments (fill IDs)
aws network-firewall create-firewall --firewall-name lab-fw --firewall-policy-arn $POLICY_ARN \
  --vpc-id $VPC --subnet-mappings SubnetId=$FW_SUBNET
aws route53resolver create-firewall-rule-group --creator-request-id lab1 --name lab-dns
# associate rule group to VPC with create-firewall-rule-group-association

Cleanup (stop billing)

1. Delete firewall endpoints / firewall / policies / rule groups.
2. Delete DNS Firewall associations and rule groups.
3. Remove lab route table edits; delete lab VPC if dedicated.
4. Confirm Cost Explorer: Network Firewall hourly charges gone.

10. Firewall decision checklist

1. Write the threat in one sentence (scan, SQLi, malware DNS, lateral SSH).
2. Pick the layer: packet / stateful / proxy / NGFW / WAF / DNS / host.
3. Pick the form: host tool, network appliance, or cloud service.
4. Default deny or default allow? Write it down.
5. Plan allow tests and deny tests before go-live.
6. Plan logging destination (file, CloudWatch, SIEM).
7. Name the on-call for false positives.
8. Link the deep chapter you will not duplicate (SG/NACL, WAF, hardening).
9. Estimate monthly cost (especially Network Firewall).
10. Schedule a reboot or failover test for persistence.

11. Copy-paste quick commands

# --- Host (Ubuntu ufw) ---
sudo ufw status verbose
sudo ufw allow OpenSSH && sudo ufw allow 80/tcp && sudo ufw enable

# --- Host (RHEL firewalld) ---
sudo firewall-cmd --permanent --add-service=http && sudo firewall-cmd --reload

# --- Host (nft) ---
sudo nft list ruleset

# --- AWS pointers (details in linked chapters) ---
aws ec2 describe-security-groups --group-ids $SG
aws wafv2 list-web-acls --scope REGIONAL --region ap-south-1
aws network-firewall list-firewalls --region ap-south-1
aws route53resolver list-firewall-rule-groups --region ap-south-1

12. More industry stories

• Retail POS (Kenji, Osaka): host FW on till PCs; network FW between stores and HQ; WAF only on ecommerce, not on private VPN APIs.
• Media streaming (Priya, Pune): CloudFront+WAF for viewers; Network Firewall for origin admin VPC; Shield Advanced on match-day.
• Gov portal (Fatima, Rabat): FMS mandates WAF CRS + DNS Firewall across ministries; local teams cannot disable.
• Startup (Diego, São Paulo): start with SG+ufw+CloudFront WAF; add Network Firewall when east-west grows.
• Logistics (Mei, Singapore): DNS Firewall blocks sinkholes; Suricata drops known C2 on inspection VPC.

13. Glossary (short)

14. Practice: explain out loud

1. 60 seconds: building-guard story for firewall types.
2. 60 seconds: iptables vs nftables vs firewalld vs ufw.
3. 60 seconds: SG vs NACL vs Network Firewall vs WAF.
4. 60 seconds: inspection VPC with Transit Gateway.
5. Record yourself once; fix filler words; record again.

15. Safe lab hygiene

• Never practice DROP rules on a production SSH session without console access.
• Tag every cloud lab resource with owner and expiry.
• Keep a written rollback: old ruleset file or SG snapshot.
• Prefer allowlists over giant denylists when starting.
• After lab, delete Network Firewall — it bills hourly.

16. How this set links other chapters

• Networking basics / ports — foundations before filters.
• SG vs NACL class — stateful vs stateless on AWS VPC.
• Linux hardening survey — SELinux, fail2ban, auditd beyond FW.
• CloudFront+WAF survey — CDN/HTTPS + light WAF.
• WAF explained / hands-on / Shield / DDoS project — L7 and DDoS depth.

17. Rule-writing workshop

Write rules in English first, then translate to the tool. Bad: "block bad stuff". Good: "Drop TCP 445 from 0.0.0.0/0 on INPUT; allow TCP 445 only from 10.0.0.0/16".

1. Name the direction: inbound, outbound, or east-west.
2. Name the 5-tuple or domain or HTTP path.
3. Name the action: accept, drop, alert, challenge.
4. Name the hit counter / log you will check.
5. Name the rollback (previous ruleset file).
6. Peer-review with someone who did not write it.

18. Sample allow / deny matrix

19. Ten oral drill questions

1. Say three differences between packet filter and stateful.
2. Name four Linux host firewall tools.
3. Why does connection refused ≠ filtered?
4. What is an inspection VPC for?
5. When is UTM a good first buy?
6. Where do Suricata rules run on AWS?
7. What does Firewall Manager stop?
8. Why link SG vs NACL instead of rewriting?
9. Give one healthcare and one fintech firewall story.
10. What do you delete first in lab cleanup for cost?

20. Common errors and fixes

Each row is a real mistake students and juniors hit. Read the fix before you panic.

21. Troubleshooting checklist

1. Flow logs: does traffic hit the firewall subnet ENI?
2. Route tables: private → fw endpoint → next hop.
3. DNS: which Resolver rule is first? Rule order matters.
4. WAF issue? Leave this chapter — open WAF logs chapter.
5. FMS non-compliant resource list in console.

22. FAQ

23. Interview Q&A

24. Tips in English, Marathi and Hindi

Revision, interview and comparison cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.