AWS Cloud Firewalls: Network Firewall, DNS Firewall, Firewall Manager आणि WAF

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. रोजचे उदाहरण

Street = WAF/Shield; lobby = Network Firewall; apartment = SG+host; phone list = DNS Firewall; FMS = org policy.

2. AWS firewall controls map

3. SG vs NACL — थोडक्यात

हे काय आहे?

SG = stateful ENI; NACL = stateless subnet. Deep lab: SG vs NACL. इथे: SG first; NACL sparingly.

4. AWS Network Firewall

हे का लागतं?

SG ने न झालेले: domain allow-list, east-west, deny+alert, Suricata IPS.

Stateless rule groups

5-tuple pass/drop/forward. आधी evaluate. Coarse drop.

Stateful rule groups

Suricata + domain lists. alert/drop/pass. Egress allow-list उदाहरण.

# Conceptual Suricata-style rule (managed in Network Firewall rule group)
# drop http $HOME_NET any -> $EXTERNAL_NET any (http.host; content:"evil.example"; sid:1000001; rev:1;)
# Domain list rule group: allow-list mode with .example.com and .amazonaws.com

Inspection VPC pattern

Spokes → TGW → inspection VPC → Network Firewall endpoints. Symmetric return. Emily = 40 VPCs.

5. DNS Firewall

VPC DNS queries filter. Allow/block/alert. Encrypted HTTPS असले तरी name lookup दिसतो.

• Malicious block
• SOC alert
• NF + DNS depth

6. Firewall Manager

Org policy: WAF/NF/DNS/SG baselines. DDoS project मध्ये वापर.

7. WAF कुठे बसते

WAF = HTTP L7. Non-HTTP/east-west = Network Firewall. Deep WAF chapters ला link.

8. Multi-industry

• Bank: inspection+DNS+FMS
• Hospital: egress deny + portal WAF
• D2C: edge WAF + light NF
• SaaS: FMS SG audit

9. Lab: NF + DNS sketch

Lab account; budget; ap-south-1.

कसं करायचं (step by step)

1. VPC + FW subnets / wizard.
2. Domain allow-list egress.
3. Routes document.
4. curl allow + deny.
5. DNS FW block test.
6. nslookup proof.
7. FMS sketch only.

# Illustrative CLI fragments (fill IDs)
aws network-firewall create-firewall --firewall-name lab-fw --firewall-policy-arn $POLICY_ARN \
  --vpc-id $VPC --subnet-mappings SubnetId=$FW_SUBNET
aws route53resolver create-firewall-rule-group --creator-request-id lab1 --name lab-dns
# associate rule group to VPC with create-firewall-rule-group-association

Cleanup

1. FW resources delete.
2. DNS FW delete.
3. Routes + VPC.
4. Cost check.

10. Firewall decision checklist

1. Threat एक वाक्य.
2. Layer निवडा.
3. Form निवडा.
4. Default policy.
5. Allow + deny tests.
6. Logging dest.
7. On-call.
8. Deep chapter link.
9. Cost estimate.
10. Persist test.

11. Copy-paste quick commands

# --- Host (Ubuntu ufw) ---
sudo ufw status verbose
sudo ufw allow OpenSSH && sudo ufw allow 80/tcp && sudo ufw enable

# --- Host (RHEL firewalld) ---
sudo firewall-cmd --permanent --add-service=http && sudo firewall-cmd --reload

# --- Host (nft) ---
sudo nft list ruleset

# --- AWS pointers (details in linked chapters) ---
aws ec2 describe-security-groups --group-ids $SG
aws wafv2 list-web-acls --scope REGIONAL --region ap-south-1
aws network-firewall list-firewalls --region ap-south-1
aws route53resolver list-firewall-rule-groups --region ap-south-1

12. अजून industry stories

• Retail: host+network; WAF ecommerce only
• Media: CF+WAF; NF admin; Shield
• Gov: FMS mandate
• Startup: grow into NF
• Logistics: DNS+Suricata

13. Glossary

14. Practice: मोठ्याने explain

1. 60s guard story.
2. 60s four tools.
3. 60s four AWS.
4. 60s inspection VPC.
5. Record ×2.

15. Safe lab hygiene

• Prod SSH + DROP = console.
• Tag owner+expiry.
• Rollback file.
• Allowlist first.
• NF hourly — delete.

16. या set ची links

• Networking basics
• SG vs NACL
• Hardening survey
• CF+WAF
• WAF/Shield set

17. Rule-writing workshop

आधी English rule, मग tool. वाईट: bad stuff. चांगले: Drop 445 except 10.0.0.0/16.

1. Direction.
2. Match fields.
3. Action.
4. Observability.
5. Rollback.
6. Peer review.

18. Allow / deny matrix

19. दहा oral drills

1. Packet vs stateful ×3.
2. Four Linux tools.
3. Refused ≠ filtered.
4. Inspection VPC.
5. UTM when.
6. Suricata on AWS.
7. FMS stops drift.
8. No duplicate.
9. Two industries.
10. NF hourly delete.

20. सामान्य errors आणि fixes

प्रत्येक row = खरी चूक. Panic करण्याआधी fix वाचा.

21. Troubleshooting checklist

1. FW ENI hit?
2. Route path.
3. Resolver order.
4. HTTP → WAF chapter.
5. FMS noncompliant list.

22. FAQ

23. Interview Q&A

24. Tips — English, मराठी आणि हिंदी

उजळणी, मुलाखत आणि तुलना cards

हा lesson काही मिनिटांत revise करा. Cards phone वर save करा किंवा PNG download करा. प्रत्येक card वरचा QR हा lesson उघडतो.

अजून cards: Ravi Sir's Cards.