Lecture 230: Introduction to AWS Network Firewall
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：09:24
- 来源：Udemy Lecture 28714194
- Slide 数量：7
- 画面切换：02:14、03:40、04:24、05:39、07:06、08:23
扫描说明
逐条读取了 Udemy 页面中的 207 条英文 Transcript cue，并按时间轴扫描全长约 09:24 的视频。依据 Stateful/Stateless、SG/NACL 限制、Firewall Endpoint Flow、控制范围对比、VPC Perimeter、Suricata/DPI、Protocol/Rule Integration 划分为 7 个小节。7 张截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Stateful Firewall 理解 Connection Context，Stateless Rule 逐 Packet 独立判断
时间范围：00:00–02:14
总结 / Summary
中文
Stateful Firewall 不只看 Source/Destination IP、Port 与 Protocol，还跟踪 Connection State 与 Packet Context，例如 TCP SYN/ACK/RST、Sequence、Fragment/Reassembly 等；已建立 Flow 的后续 Packet 可按 State Table 处理。Stateless Firewall 则把每个 Packet 作为独立事件匹配 Rule，不因 Connection 已获准而自动允许 Return Traffic。AWS Network Firewall 同时支持 Stateless 与 Stateful Rule，但整体定位是 Managed Stateful Network Firewall/IDS/IPS。
English
A stateful firewall evaluates more than source and destination IPs, ports, and protocol: it tracks connection state and packet context such as TCP SYN, ACK, or RST flags, sequence information, and fragmentation or reassembly. Packets in an established flow can be handled through a state table. A stateless firewall evaluates each packet independently and does not automatically allow return traffic because a connection was previously accepted. AWS Network Firewall supports both stateless and stateful rules while serving as a managed stateful firewall and IDS/IPS.
Transcript
00:00 Hello and welcome to this lecture,
00:03 AWS Network Firewall.
00:07 So, as of now we have seen a couple of firewalls already.
00:09 You know how security group works
00:12 and you know how the network ACL works.
00:16 And we briefly talked about AWS WAF and AWS shield as well.
00:19 Now, considering that we have so many firewalls
00:21 why this new firewall, that is AWS Network Firewall.
00:25 Now, before we really jump into the details
00:28 of AWS Network Firewall, I want to let you know
00:32 that there are two types of firewalls typically, right?
00:35 And we also talked about this in context
00:38 of security groups and network ACL.
00:41 So, one is the stateful firewalls.
00:43 Now what the stateful firewall means?
00:46 It means that it filters the traffic
00:48 based on network packet context,
00:50 as well as connection state.
00:52 But what does that mean, right?
00:53 So the context means that it involves the metadata
00:57 of the packet including the IP addresses, ports,
00:59 packet length, information about, you know, reassembly
01:02 and defragmentation flags, TCP sequence number.
01:05 So it's not just about source IP addresses,
01:08 source port destination IP addresses, destination port,
01:11 and protocol, right?
01:12 It is much more than that.
01:13 It actually looks at your connection, its state,
01:18 if you're using say ICMP then, is your packet allowed
01:23 to be defragmented, and similar things.
01:26 So that's a context of the packet.
01:29 And state refers to the connection of the state.
01:31 For example, during the TCP handshake,
01:34 you know that there are SYN flags
01:36 and acknowledgement flags are set, right?
01:38 And then the handshake complete.
01:40 So stateful firewalls can also look at these flags
01:43 and can decide whether you want
01:45 to allow that traffic or not.
01:47 And opposite of the stateful is stateless firewall.
01:51 So when we talked about network ACL,
01:53 we said that network ACL is a stateless
01:56 because network ACL rules operate in isolation.
01:59 That means it doesn't care whether it's a traffic,
02:02 is a part of a connection, which is already approved.
02:05 It always looks at the packet in isolation
02:08 and apply all the rules that you write there.
02:10 So at high-level, these are the two types
02:12 of the firewall that you will find.
2. SG/NACL 只做 IP/Port/Protocol Filtering，无法完成 Deep Inspection
时间范围：02:14–03:40
总结 / Summary
中文
Security Group 作用于 ENI，Network ACL 作用于 Subnet，二者都会检查 Layer 3/4 的 IP、Port、Protocol，并且流量通常同时经过它们。但它们不解析 Application Payload、Header Pattern、Domain 或真实 Protocol，也不提供 IDS/IPS-style Deep Packet Inspection。因此 SG/NACL 仍是基础 Boundary Control，却不能满足 Domain Blocking、Signature Detection 或 Payload-aware Policy。
English
Security groups operate at ENIs and network ACLs at subnet boundaries; both filter Layer 3/4 IPs, ports, and protocols, and traffic commonly traverses both. They do not interpret application payloads, header patterns, domains, or the real protocol, and they do not provide IDS/IPS-style deep packet inspection. SGs and NACLs remain essential boundary controls but cannot satisfy domain blocking, signature detection, or payload-aware policy.
Transcript
02:14 And if you talk about AWS Network Firewall,
02:16 it supports both stateful rules as well as stateless rule.
02:20 But overall, you can consider the AWS Network Firewall
02:24 as a stateful network firewall,
02:26 and which is also an intelligent intrusion detection
02:29 and prevention service for your VPC, right?
02:33 So if you look at this architecture,
02:35 you know that inside VPC you have subnets
02:37 and then you launch EC2 machines,
02:40 and then you want to put a firewall.
02:42 The first thing you will use is a security group,
02:45 which works at an ENI level.
02:47 And if you want a subnet level protection,
02:49 then you will put network ACL.
02:51 Now, this is very simple.
02:53 The traffic which is coming from or going
02:56 to the EC2 instance, it has to pass
02:59 through both these firewalls.
03:01 So this works well.
03:02 But if you look at these two firewalls, right?
03:04 Network ACL and security group, they just allow you to,
03:08 you know, provide the source IP address range
03:10 or a destination IP address range for outbound rules
03:13 and then the port numbers, right?
03:15 The ports of the EC2 machine where the traffic can reach,
03:19 or the port number of the destination machine,
03:21 where the outbound traffic can reach.
03:23 It doesn't really consider, you know, the payload
03:27 of the data, the header information, all this is not checked
03:31 by these two firewalls.
03:33 And that's where you can't really do
03:35 the deep packet inspection with these two firewalls.
03:38 So the solution to that is of course,
3. Route Table 把双向流量 Steering 到 Firewall Endpoint
时间范围：03:40–04:24
总结 / Summary
中文
部署 AWS Network Firewall 时，会在选定 Availability Zone 的专用 Subnet 中建立 Firewall Endpoint。Route Table 必须把需要检查的 Ingress、Egress 或 East-West Traffic 先送到 Endpoint；Service 根据 Firewall Policy/Rule Group 检查后，再把允许的 Packet 路由到 EC2、Internet/NAT 或其他目的地。Return Path 也必须经过相应 Endpoint，避免 Asymmetric Routing 绕过 Stateful Inspection。
English
Deploying AWS Network Firewall creates firewall endpoints in dedicated subnets for selected Availability Zones. Route tables must steer the intended ingress, egress, or east-west traffic to an endpoint first; the service inspects it using the firewall policy and rule groups, then permitted packets continue toward EC2, the Internet or NAT, or another destination. The return path must traverse the corresponding endpoint as well to avoid asymmetric routing that bypasses stateful inspection.
Transcript
03:40 AWS Network Firewall.
03:42 The way it works is you provision
03:43 the network firewall endpoint inside your VPC.
03:47 And when you say VPC, that means again,
03:49 there are subnets and then all the traffic
03:52 which is going to your machines inside your VPC,
03:55 it should be routed through this firewall endpoint.
03:58 So first the traffic will land into firewall endpoint,
04:02 it will then go to AWS Network Firewall.
04:04 It will inspect your packet as per the rules
04:07 that you have written, and finally,
04:09 the traffic will reach to your instance.
04:11 And same applies for the return traffic as well,
04:15 or the outbound traffic, which initiates
04:17 from your EC2 instances, right?
04:20 So this is how the network firewall works
04:22 at very, very high-level.
4. SG、NACL、WAF 与 Network Firewall 的 Scope/State/OSI 对比
时间范围：04:24–05:39
总结 / Summary
中文
Security Group 是 ENI-level Stateful Layer 3/4 Allow Control；NACL 是 Subnet-level Stateless Layer 3/4 Allow/Deny Control；WAF 关联 ALB、CloudFront、API Gateway 等 Endpoint，仅检查 Ingress HTTP(S) Layer 7；Network Firewall 则按 Route 覆盖 VPC Ingress/Egress 与可选 East-West Flow，同时提供 Stateless/Stateful Rule，从 Layer 3 延伸到 Layer 7 特征。选择服务时先明确 Enforcement Point、Traffic Direction 与 Inspection Depth。
English
Security groups are ENI-level, stateful Layer 3/4 allow controls. NACLs are subnet-level, stateless Layer 3/4 allow and deny controls. WAF associates with endpoints such as ALB, CloudFront, or API Gateway and inspects inbound HTTP(S) at Layer 7. Network Firewall uses routing to cover VPC ingress, egress, and selected east-west flows with both stateless and stateful rules spanning Layer 3 through Layer 7 signatures. Service selection starts with enforcement point, traffic direction, and inspection depth.
Transcript
04:24 And now let's try to answer the question,
04:26 why one more firewall, right?
04:29 So you already have security groups,
04:31 you already have network ACL,
04:32 you already have WAF, but then what is different
04:36 about AWS network firewall?
04:38 So first thing protection at,
04:40 at which level it provides the protection,
04:42 security group, EC2 instance level,
04:44 or you can say at ENI level,
04:46 network ACL provides the protection at subnet level.
04:49 WAF is an endpoint which protects you
04:52 at load balancer and CloudFront
04:54 and you know that it works at layer seven.
04:57 However, network firewall will provide the protection
04:59 for all inbound and outbound traffic
05:02 to and from your VPC, right?
05:05 Stateful or stateless,
05:07 you know that security groups are stateful,
05:10 which means that any traffic which is coming in it
05:13 allows the return traffic and in case of network ACL,
05:17 you have to look at the packet in isolation.
05:19 That means it's stateless.
05:21 WAF is also stateless and network firewall
05:24 allows both stateless and stateful rules.
05:27 So, OSI layer security group and network ACL works
05:31 at layer three and layer four.
05:33 WAF works at layer seven.
05:34 Network firewall will work from layer three to layer seven.
5. VPC Perimeter 可覆盖 IGW、NAT、VPN/DX 与 VPC-to-VPC Flow
时间范围：05:39–07:06
总结 / Summary
中文
Network Firewall 可过滤经 Internet Gateway、NAT Gateway、Virtual Private Gateway、VPN、Direct Connect（经相关 Gateway/Route）以及 VPC-to-VPC Path 的流量，前提是 Route Table 把该 Flow 导向 Firewall Endpoint。它支持 Stateless ACL-like Rule、Stateful Layer 4 Rule、IPS/IDS Layer 7 Rule、Domain List 与 Large IP Allow/Block List。All traffic 并非自动成立：未经过 Endpoint 的 Route 仍会绕过检查。
English
Network Firewall can filter traffic using Internet gateways, NAT gateways, virtual private gateways, VPN, Direct Connect paths through relevant gateways, and VPC-to-VPC routes—provided route tables direct those flows to firewall endpoints. It supports stateless ACL-like rules, stateful Layer 4 rules, IPS or IDS Layer 7 rules, domain lists, and large IP allow or block lists. It does not automatically see all traffic; any route that bypasses an endpoint also bypasses inspection.
Transcript
05:39 Now if you talk about the features,
05:41 again, security group allows you to filter traffic based
05:43 on the IP port and protocol, same with the network ACL,
05:47 and in case of WAF, you can write various rules, right?
05:51 Whether cross-site scripting
05:52 or blocking particular IP address or rate-limiting rules,
05:57 but in case of network firewall,
05:58 it is much more intelligent.
06:00 So you can write a stateless rules or stateful rules.
06:04 You can block access to a particular domain,
06:07 or you can detect the protocols
06:09 like whether it's a TLS connection or not.
06:12 And it can also allow you to have a large IP blocks
06:15 to be, you know, whitelisted or blacklisted.
06:19 So network firewall will give you all this protection.
06:22 Now with respect to the flows, security group allows,
06:26 or you can apply the security group for both ingress
06:29 and egress traffic, same with the network ACL.
06:32 In case of WAF, as I said,
06:35 only the ingress traffic is filtered.
06:37 And in case of network firewall, again,
06:39 you can apply the firewall rules in both the directions
06:43 and it is applied at the perimeter of VPC.
06:46 That means whether traffic is flowing
06:48 through internet gateway or virtual private gateway,
06:52 or whether DX or VPN, or between the VPC
06:54 to VPC communication, right?
06:57 So if you look at this network firewall
06:59 has much larger scope than the other firewalls.
07:04 Okay, so I hope that is clear.
6. Suricata-compatible Stateful Rule、Domain Filter 与 Deep Packet Inspection
时间范围：07:06–08:23
总结 / Summary
中文
Stateful Rule Group 可使用 Suricata-compatible Rule Syntax，把 Open-source IDS/IPS Signature 引入 AWS Managed Firewall。Domain List Rule 可 Allow/Block 指定 FQDN 或 Wildcard Domain；Deep Packet Inspection 不仅看 Packet Header，还检查可见 Payload/Protocol Pattern。需要注意 Encryption Boundary：没有 TLS Inspection/Decryption 时，Firewall 无法读取加密 Application Payload，只能利用握手与可见 Metadata。
English
Stateful rule groups can use Suricata-compatible syntax, bringing open-source IDS and IPS signatures into the AWS-managed firewall. Domain-list rules allow or block specific FQDNs or wildcard domains, while deep packet inspection evaluates visible payload and protocol patterns in addition to packet headers. Encryption remains a boundary: without TLS inspection or decryption, the firewall cannot read encrypted application payload and must rely on handshake or other visible metadata.
Transcript
07:06 And now let's look at quickly,
07:08 what are the features of network firewall?
07:10 So it filters the traffic at the perimeter of the VPC,
07:13 such as the traffic going to or coming
07:15 from the internet gateway, NAT gateway,
07:17 over a VPN or a Direct Connect.
07:20 And for stateful rules specifically,
07:24 you can use something called Suricata
07:26 which is an open source rule set,
07:29 which has been developed by the community.
07:31 So Suricata is an open source-based intrusion
07:34 detection system and intrusion prevention system,
07:36 in short IDS and IPS.
07:39 And you can use all the Suricata rules
07:42 into your network firewall.
07:44 It also allows you to filter the domain names.
07:48 That means if you don't want to allow access
07:51 to any other domain than to aws.amazon.com,
07:55 you can do that with the network firewall.
07:58 Also it can block access to the bad domain.
08:02 You can also use wildcard into a domain name,
08:05 and it also allows you to do the deep packet inspection.
08:09 So what that means is it does not only just look
08:12 at the packet header, but it can also look
08:14 at the packet payload and maybe edit out information
08:18 about the packet, right?
08:19 So that kind of deep packet inspection
08:21 you can do with the network firewall.
7. Protocol Detection 不只信任 Port，并可导入 Open-source/Partner Rule
时间范围：08:23–09:24
总结 / Summary
中文
Port Number 不保证真实 Application Protocol：TCP/443 上也可运行非 HTTPS Service。Stateful Protocol Detection 可识别 Flow 是否真正符合 TLS/HTTPS 等 Protocol，并对不匹配 Traffic Drop/Alert。除手写 Rule 外，还能导入通用 Suricata Format 或使用 AWS Partner Solution 提供的 Managed/Curated Rule Feed。这样可把自有 Threat Intelligence 与第三方 Signature 纳入同一 Firewall Policy。
English
A port number does not guarantee the real application protocol; non-HTTPS services can run on TCP 443. Stateful protocol detection identifies whether a flow actually follows TLS or HTTPS behavior and can drop or alert on mismatches. In addition to custom rules, organizations can import common Suricata-format rules or integrate curated feeds from AWS partner solutions, incorporating internal threat intelligence and third-party signatures into one firewall policy.
Transcript
08:23 Okay, next is about the protocol detection.
08:26 So you know that when the traffic is going
08:28 over 443, then you assume
08:30 that it's an HTTPS protocol, but that isn't necessarily
08:35 that you can run different services also
08:38 on the 443, but the network firewall
08:40 can intelligently detect that the protocol is really
08:44 an HTTPS and that's where you can say any other traffic
08:47 than the HTTPS you want to drop it, right?
08:49 You don't want to allow that.
08:50 So this is possible with network firewall.
08:53 And finally, you can import your rules which are written
08:53 in a common open source rule format like Suricata,
08:56 as well as, if there are third party partners,
09:02 you can also integrate network firewall with them
09:06 and you can, you know, import those rules
09:09 from those solutions as well.
09:11 So in short, that is what the network firewall is.
09:15 And now let's look at the firewall components,
09:17 routing, VPC architecture and how to write those rules.
09:22 So, thanks for watching.
整讲总结 / Overall Summary
中文
AWS Network Firewall 是通过 VPC Route Table 插入路径的 Managed Stateful Firewall/IDS/IPS，同时支持 Stateless 与 Stateful Rule。它补足 SG/NACL 只能看 IP/Port/Protocol、WAF 只面向 Web Ingress 的局限，可做 Suricata Signature、Domain Filter、Protocol Detection 与可见 Payload 的 Deep Inspection。正确架构的关键是每 AZ Endpoint、对称路由、覆盖所需 Ingress/Egress/East-West Flow，并理解 TLS 加密对检查能力的限制。
English
AWS Network Firewall is a managed stateful firewall and IDS/IPS inserted through VPC routing, with both stateless and stateful rules. It extends beyond SG or NACL IP-port filtering and WAF's web-ingress focus by supporting Suricata signatures, domain filtering, protocol detection, and deep inspection of visible payloads. Correct architecture requires per-AZ endpoints, symmetric routing, deliberate coverage of ingress, egress, and east-west flows, and awareness of TLS encryption limits.
返回顶部 ↑