Lecture 231: AWS Network Firewall - VPC and Route tables
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：03:52
- 来源：Udemy Lecture 28714204
- Slide 数量：4
- 画面切换：00:47、01:36、02:29
扫描说明
逐条读取了 Udemy 页面中的 92 条英文 Transcript cue，并按时间轴扫描全长约 03:52 的视频。依据 Subnet/Endpoint 准备、IGW Ingress Routing、Firewall/Protected Subnet Route Table、双向 Flow Sequence 划分为 4 个小节。该讲的 Udemy Player 将 16:9 视频显示在较矮画布中，因此截图从实际视频内容区精确裁取后统一为 1364×770，并已逐张复核。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Protected Subnet 与 Firewall Subnet 分离部署 Endpoint
时间范围：00:00–00:47
总结 / Summary
中文
简化图只画一个 Availability Zone：EC2/Database 位于 Protected Subnet；另建 Dedicated Firewall Subnet，并在其中 Provision AWS Network Firewall Endpoint（Route Target 形式通常为 vpce-...）。Firewall Endpoint 再连接 Regional Network Firewall Service。生产环境应在每个承载流量的 AZ 建立对应 Firewall Endpoint，并让工作负载使用同 AZ Endpoint，避免跨 AZ 路由、额外费用与单点。
English
The simplified diagram uses one Availability Zone. EC2 instances or databases reside in a protected subnet, while a dedicated firewall subnet contains an AWS Network Firewall endpoint whose route target is typically vpce-.... The endpoint connects to the regional Network Firewall service. Production designs deploy an endpoint in every traffic-carrying AZ and keep workloads on the same-AZ endpoint to avoid cross-AZ routing, added cost, and a single point of failure.
Transcript
00:00 Hello and welcome to this lecture.
00:05 So, now let's look at the VPC setup for Network Firewall.
00:06 And how would you configure your Route table
00:09 so that traffic can be inspected
00:11 using the Network Firewall.
00:16 And for simplicity, I'm just using
00:17 one availability zone here.
00:19 And then you would have your machines,
00:21 your databases inside your protected subnet.
00:25 Now, this could be a public subnet or a private subnet,
00:28 but we are just calling it protected as of now.
00:31 Now, for using the Network Firewall,
00:33 you would also need a Firewall Subnet
00:36 in which you will provision the Firewall endpoint,
00:40 which ultimately has the connection
00:43 with your AWS Network Firewall in your AWS region.
2. IGW Ingress Route Table 把目标 Workload CIDR 送入 Firewall Endpoint
时间范围：00:47–01:36
总结 / Summary
中文
Internet Inbound Packet 先到 Internet Gateway。通过 IGW Edge Association 的 Ingress Route Table，将 Protected Subnet CIDR（例如 10.0.0.0/24）的 Target 指向该 AZ 的 Firewall Endpoint，而不是直接使用 VPC local Route 进入 Workload。这样所有从 Internet 访问 Public Workload 的 Traffic 会先进入 Inspection Path。VPC CIDR 的其他 Local Route 仍保留，用于未被更具体 Route 覆盖的内部通信。
English
Internet inbound packets first reach the Internet gateway. An edge-associated IGW ingress route table sends the protected subnet CIDR—for example, 10.0.0.0/24—to the AZ's firewall endpoint rather than directly following the VPC local route to the workload. This forces Internet traffic for public workloads into the inspection path. The broader VPC local route remains for internal destinations not overridden by the more specific entry.
Transcript
00:47 Now, when your traffic is coming from, say internet,
00:51 then you how to make sure that now all the traffic lands
00:55 into a Firewall endpoint first,
00:56 and from there, then it goes to your machines, right?
01:00 So for Inbound traffic, for example,
01:03 whatever traffic coming from the internet,
01:05 you have to tell that if traffic is going
01:07 to the workload subnet, which you have protected,
01:11 the traffic has to go through something
01:13 called the endpoint for your firewall,
01:15 which has a syntax like vpce- some number.
01:20 So, once you do that,
01:23 your traffic goes to the Firewall endpoint.
01:25 Now, you must be wondering
01:26 that how you can have the Route table
01:28 for the Internet gateway?
01:30 BUt Internet gateway does provide something
01:32 called Ingress routing Route table,
01:34 where you can define these routes.
3. Firewall 与 Protected Subnet Route Table 建立对称 Return Path
时间范围：01:36–02:29
总结 / Summary
中文
Firewall Subnet Route Table 保留 VPC CIDR 的 local，并把 Internet-bound 0.0.0.0/0 指向 IGW；Protected Subnet Route Table 同样保留 local，但把 Default Route 指向 Firewall Endpoint。于是 Workload 发起的 Outbound Traffic 和对 Inbound Request 的 Return Traffic 都先回到 Endpoint，再由 Firewall Subnet Route 送往 IGW。入口与回程对称，Stateful Flow 才不会被绕过或因 Asymmetric Routing 丢弃。
English
The firewall-subnet route table retains the VPC CIDR local route and sends Internet-bound 0.0.0.0/0 to the IGW. The protected-subnet route table also retains local but points its default route to the firewall endpoint. Consequently, workload-originated outbound traffic and return traffic for inbound requests both revisit the endpoint before the firewall subnet sends them to the IGW. Symmetric ingress and return paths prevent stateful inspection from being bypassed or disrupted by asymmetric routing.
Transcript
01:36 Now second, when the traffic lands
01:38 into the Firewall endpoint,
01:40 it has to make sure that traffic ultimately goes
01:43 to your target machines, right?
01:45 That's where you will see
01:46 that any local traffic will be routed
01:49 through the local VPC router
01:50 and this IP is a part of that.
01:53 But any outgoing traffic,
01:55 from firewall will go through the Internet gateway,
01:58 and this is essentially
01:59 for the return traffic from your machines,
02:02 or the outbound originating traffic from your machines.
02:06 And finally your protected subnet
02:08 would again have the local route entry,
02:11 as well as the entry for any outbound traffic,
02:15 which is say 0.0.0.0.
02:16 It will always go through the Firewall endpoint
02:19 and then Firewall endpoint further
02:21 will forward this traffic to the internet,
02:23 through the Internet gateway.
02:25 And this is how the end to end traffic will look like.
4. Inbound 与 Outbound 每个方向都必须经过 Endpoint
时间范围：02:29–03:52
总结 / Summary
中文
Inbound Sequence 是 Internet → IGW → Firewall Endpoint → AWS Network Firewall → Protected Workload，Response 再按 Workload → Endpoint/Firewall → IGW → Internet 返回。Outbound Sequence 从 Workload → Endpoint/Firewall → IGW → Internet 开始，Internet Response 再经 IGW Ingress Route → Endpoint/Firewall → Workload。检查 Route Table 时要逐 Hop 验证正向与反向，而不是只确认 Default Route；任何一跳直接走 local 或 IGW 都可能绕过 Firewall。
English
The inbound sequence is Internet to IGW to firewall endpoint to AWS Network Firewall to the protected workload, with the response returning from workload through the endpoint and firewall to the IGW and Internet. The outbound sequence begins workload to endpoint and firewall to IGW and Internet; the response returns through the IGW ingress route, endpoint, firewall, and workload. Route review must validate both directions hop by hop rather than checking only a default route, because a direct local or IGW path can bypass inspection.
Transcript
02:29 So this is the Inbound flow.
02:30 And if you talk about the sequence,
02:33 you get the request from internet.
02:35 It goes to the Internet gateway.
02:37 It will be routed through Firewall endpoint,
02:39 Firewall endpoint will talk to actual AWS Network Firewall,
02:43 and then it will get response from there,
02:45 and finally, traffic will be routed to your machine.
02:48 Now, this machine will also respond,
02:51 and the traffic will go to your Network Firewall,
02:53 and from there, again, the traffic will go
02:56 to the Internet gateway to the internet back.
02:59 So this is how Inbound flow would look like.
03:01 Now if you talk about the Outbound flow, things are similar.
03:05 Same Route tables.
03:07 And in this case,
03:08 traffic will be originated at your machine,
03:11 goes to the Firewall endpoint.
03:12 From there goes to the AWS Network Firewall.
03:15 It will respond.
03:16 From there, it will go
03:17 to the Internet gateway, to the internet.
03:20 And then you'll get a response from the internet,
03:22 Traffic will again land into the Network Firewall endpoint,
03:25 again to the Network Firewall,
03:27 and back to your machine.
03:28 So, you see, whether it's an Inbound or Outbound traffic,
03:32 every time it has been intercepted
03:34 by your Network Firewall endpoint.
03:36 And that's the whole purpose
03:38 of using the AWS Network Firewall.
03:41 So, that's it about the Inbound and Outbound flow,
03:44 and the route tables for your VPC that you'll design
03:47 for using the Network Firewall.
03:49 So, thanks for watching.
整讲总结 / Overall Summary
中文
Network Firewall 的核心不是仅创建 Firewall，而是通过 Route Table 保证所有目标 Flow 都经过 Endpoint。IGW Ingress Route 把 Protected CIDR 指向 Endpoint；Protected Subnet Default Route 指向 Endpoint；Firewall Subnet Default Route 指向 IGW。多 AZ 中要为每个 AZ 建 Endpoint 并保持同 AZ、对称路由，逐 Hop 验证 Inbound、Return、Outbound 与 Response 四条路径。
English
Network Firewall works only when routing forces the intended flows through its endpoints. The IGW ingress route sends the protected CIDR to an endpoint, the protected subnet default route sends egress to that endpoint, and the firewall subnet default route sends permitted traffic to the IGW. Multi-AZ designs require per-AZ endpoints, same-AZ routing, and symmetric paths, with inbound, return, outbound, and response flows verified hop by hop.
返回顶部 ↑