Lecture 232: AWS Network Firewall Components & Rule groups
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：12:32
- 来源：Udemy Lecture 28714800
- Slide 数量：9
- 画面切换：01:39、03:45、05:04、05:38、06:54、08:08、09:02、10:22
扫描说明
逐条读取了 Udemy 页面中的 284 条英文 Transcript cue，并按时间轴扫描全长约 12:32 的视频。该讲底层 Video 元数据不可读，首次自动时间为无效的全 0；已丢弃并改用播放器可见时钟逐条重新采集，最终时间轴覆盖 00:00–12:27。依据 Firewall/Policy/Rule Group、Packet Flow、Stateless、5-Tuple、Stateful、Domain List、Suricata、Signature、Evaluation Order 划分为 9 个小节。9 张截图从实际视频内容区精确裁取，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Firewall、Firewall Policy 与 Rule Group 三层组件
时间范围：00:00–01:39
总结 / Summary
中文
AWS Network Firewall 是 Regional Resource，连接要保护的 VPC 与具体 Protection Behavior。Firewall 只能关联一个 Firewall Policy，但同一 Policy 可复用于多个 Firewall。Policy 定义 Stateless/Stateful Rule Group、Stateless Default Action 等全局行为；Rule Group 则是一组实际的 Stateless 或 Stateful Rule，决定如何 Inspect 与 Handle Traffic。分层让 Endpoint/VPC Attachment 与可复用 Security Logic 解耦。
English
AWS Network Firewall is a regional resource that connects a protected VPC to defined protection behavior. A firewall associates with one firewall policy, while one policy can be reused by multiple firewalls. The policy selects stateless and stateful rule groups and defines global behavior such as stateless default actions. Rule groups contain the actual stateless or stateful rules that inspect and handle traffic. This separates endpoint and VPC attachment from reusable security logic.
Transcript
00:00 Hello and welcome to this lecture,
00:01 network firewall components.
00:03 And in this lecture, we will see everything
00:05 about a firewall policy, rules, the stateless rules,
00:09 stateful rules that AWS network firewall provides.
00:12 So, this is the important lecture,
00:14 if you want to really understand how network firewall works.
00:17 So, at very high level network firewall
00:19 contains the firewall.
00:22 So, again, it's a regional service that you can create.
00:25 So, ultimately firewall connects the VPC
00:28 that you want to protect to the protection behavior
00:31 that you define using the firewall policy.
00:33 So, firewall will come with firewall policy.
00:36 And in firewall policy, basically,
00:39 you configure what are the rule groups
00:41 that you want to include in this firewall policy, right?
00:44 And this rule groups could be a stateless
00:46 as well as stateful rule groups.
00:48 And then there are some other settings, for example,
00:51 in case of stateless rule groups,
00:53 what is the default action if there is no match for,
00:56 you know, incoming packets,
00:58 if none of the rule matches,
01:00 then what action it should be taken,
01:02 whether traffic should be allowed or dropped,
01:04 or it should be forwarded to a stateful rule group?
01:07 So, you can define that kind of configurations
01:10 for firewall policy.
01:12 And remember that you can associate each firewall
01:15 with just one firewall policy.
01:17 However, one firewall policy can be attached
01:20 to multiple firewalls.
01:22 And the third component is of course rule groups.
01:25 And rule groups are nothing
01:26 but a collection of stateless and stateful rules
01:29 that define how to inspect and handle network traffic.
01:33 So, at high level, there is a firewall, firewall policy,
01:36 and the collection of the rule groups.
2. Packet 先过 Stateless Engine，再 Pass/Drop/Forward 到 Stateful
时间范围：01:39–03:45
总结 / Summary
中文
Incoming Packet 首先按 Priority 进入 Stateless Rule Group。命中后可 aws:pass 直接放行、aws:drop 丢弃，或 aws:forward_to_sfe 转给 Stateful Engine；若无 Rule Match，则执行 Firewall Policy 的 Stateless Default Action，同样可 Pass、Drop 或 Forward。Stateful 阶段可使用 Standard 5-Tuple、Domain List、Suricata Rule，并对 Match 执行 Pass、Drop 或 Alert/Log。通常要把需要深度检查的流量 Forward 到 Stateful Engine，而不是在 Stateless 阶段提前 Pass。
English
An incoming packet first enters stateless rule groups in priority order. A match can aws:pass it immediately, aws:drop it, or aws:forward_to_sfe for stateful inspection. If no rule matches, the firewall policy's stateless default action likewise passes, drops, or forwards. The stateful stage can use standard five-tuple, domain-list, and Suricata rules with pass, drop, or alert and logging outcomes. Traffic needing deep inspection should be forwarded rather than prematurely passed by stateless processing.
Transcript
01:39 If I want to show that in a diagram,
01:42 this is how it would look like.
01:43 You would have firewall, you would have firewall policy.
01:46 And inside policy, you will define the stateless rule groups
01:50 as well as stateful rule groups.
01:52 Now here, if you look at this,
01:54 the incoming traffic that you want to inspect,
01:58 first, the stateless rule groups will be applied
02:01 and we'll see if there is any match.
02:04 Now, if there is a match,
02:05 then it can take further action
02:07 whether the packet has to be dropped,
02:09 or it has to be passed,
02:10 or it has to be forwarded to the stateful rule groups.
02:13 And we'll understand more about this.
02:15 Now, one more thing to understand,
02:17 that in case of stateful rule groups
02:18 that are just standard 5-tuple rules, like you know,
02:22 source address, destination address,
02:24 source port destination address, and a protocol, right?
02:27 Because they are the stateless rules.
02:30 And in case there is no match for any of these
02:33 tech lists rule groups and the rules inside those,
02:37 then there is a default action that you can set
02:40 inside your firewall policy.
02:42 It says if traffic doesn't match any stateless rule group,
02:47 what actions should be taken,
02:48 whether the packet should be dropped,
02:49 or it should be passed,
02:51 or it should be forwarded to the stateful rule groups?
02:54 So, ideally you would want to
02:57 for only to stateful rule groups as well, so that,
02:59 then you can apply, you know, IPS and IDS rules.
03:03 And once it reaches the stateful firewall rule groups
03:06 then you can define multiple types of the rules,
03:09 the standard 5-tuple rules
03:10 similar to the stateless rule group.
03:13 And then you can also define domain list rules
03:15 where you can whitelist or blacklist particular domain.
03:18 And then most important is Suricata based rules
03:22 that you can define.
03:23 And we'll learn about these rules as well.
03:25 Now, for stateful rules as well,
03:27 there is action like you can drop the packet
03:29 if it matches or pass the packet,
03:31 or you can just send an alert which can be logged
03:34 into the firewall logs.
03:36 So, this is how the flow of the packet will look like
03:40 while using the firewall and the firewall policies.
03:43 So, I hope that it's clear.
3. Stateless Rule Group：逐 Packet、Priority-first、NACL-like
时间范围：03:45–05:04
总结 / Summary
中文
Stateless Rule 不跟踪 Flow Direction 或 Existing Connection，每个 Packet 独立匹配 Protocol、Source IP/Port、Destination IP/Port。Rule 以数值 Priority 排序，数值越小越先评估；第一个 Match 决定 Pass、Drop 或 Forward to Stateful，随后停止 Stateless Rule Evaluation。Custom Action 可发布 CloudWatch Metric 等 Signal。其思维方式类似 NACL，但由 Firewall Policy 集中管理并可无缝衔接 Stateful Engine。
English
Stateless rules do not track flow direction or existing connections; each packet independently matches protocol, source IP and port, and destination IP and port. Numeric priorities evaluate from lower to higher, and the first match determines pass, drop, or forward to stateful before stateless evaluation stops. Custom actions can publish signals such as CloudWatch metrics. The model resembles a NACL but is centrally managed in the firewall policy and can feed the stateful engine directly.
Transcript
03:45 Now, let's understand what stateless rule groups offer.
03:48 So, it inspects the each packet in isolation
03:51 that we learned about the stateless firewalls already.
03:54 And it does not take into consideration factors
03:57 such as direction of the traffic, or whether the packet
03:59 is a part of an existing or approved connections.
04:02 And it provides the standard 5-tuple connection criteria,
04:06 like, what should be the protocol?
04:08 What is in source IP address range?
04:10 What is a source port range, destination IP address range,
04:13 and destination port range?
04:15 And if there is a match then appropriate action is taken.
04:18 The packet can be passed, or dropped,
04:20 And when you write the multiple rules
04:25 in the stateless rule groups, you can prioritize the rules.
04:27 The lower the number, the higher the priority of the number.
04:31 And they'll be evaluated in that priority order.
04:33 The action it supports is a pass, drop,
04:38 or forward to stateless.
04:40 And it also allows some custom actions.
04:42 If you want to just send CloudWatch metrics
04:44 regarding your rule match, you can also do that.
04:49 So, you can consider this stateless rule group
04:52 similar to the behavior of network ACL
04:54 because network ACL's are also stateless.
04:56 They don't consider the flow
04:59 or the direction of the traffic it's flowing through.
05:01 So, in short, that's a stateless rule group.
4. Stateless 5-Tuple Rule 可额外匹配 TCP Flags
时间范围：05:04–05:38
总结 / Summary
中文
完整 Stateless Rule 包含 Priority、Action 与 Match Setting。5-Tuple 是 Protocol、Source CIDR、Source Port Range、Destination CIDR、Destination Port Range；还可选配 TCP Flag，例如 SYN、ACK、FIN、RST，从而只匹配握手或连接终止阶段的特定 Packet。由于 Rule 不保存 State，同一 Connection 的反向与后续 Packet 仍需分别由适当 Rule/Default Action 处理。
English
A complete stateless rule contains a priority, action, and match settings. The five tuple consists of protocol, source CIDR, source port range, destination CIDR, and destination port range, with optional TCP flags such as SYN, ACK, FIN, or RST for matching specific handshake or teardown packets. Because the rule stores no state, reverse and subsequent packets in the same connection still require appropriate rules or default actions.
Transcript
05:04 Now, how the rules in stateless rule group look like.
05:06 There are 5-tuple as I said.
05:10 There is a priority. There is an action.
05:11 And then rule match setting should have protocol, source IP,
05:14 source port range, destination IP,
05:18 and destination port range.
05:20 Optionally, there is also a TCP flags.
05:22 That means, if you know the TCP flags, like for example,
05:24 in a handshake there is a syn and acknowledge,
05:29 and RSD kind of flags. Those are set.
05:32 You can also try to match those flags in your packet.
05:34 So, this is what does stateless rules look like.
5. Stateful Rule Group 跟踪 Flow，并区分 Default Action Order/Strict Order
时间范围：05:38–06:54
总结 / Summary
中文
Stateful Engine 考虑 Flow Context、Direction 与 Connection State，支持 Standard Rule、Suricata-compatible Rule 和 Domain List。按本讲展示的 Default Action Order，Engine 先评估 Pass，再 Drop，最后 Alert；同一 Action 内再依据 Rule Priority 处理，且未命中的流量默认通过。实际配置还可选择 Strict Order，在 Policy 中按自定义顺序和 Stateful Default Action 控制行为。不要把 Security Group 的 Default-deny Inbound 直觉套到默认 Stateful Engine。
English
The stateful engine considers flow context, direction, and connection state and supports standard, Suricata-compatible, and domain-list rules. Under the lecture's default action order, pass rules evaluate before drop and then alert rules, with rule priority considered within an action, and unmatched traffic is permitted. Deployments can instead use strict order and policy-defined stateful default actions for explicit sequencing. The security group's default-deny-inbound intuition does not automatically apply to the default stateful engine.
Transcript
05:38 Now, let's understand the stateful rule groups.
05:41 As I said, it takes into the consideration
05:44 the context of the flow
05:46 and the state of the connection as well.
05:47 And it supports the Suricata compatible rules,
05:50 which is an opensource intrusion prevention system.
05:54 And it also supports the domain list filtering rules
05:57 as well.
06:00 Also, about the order of the processing,
06:01 it's not like a stateless rule,
06:03 but, first, it looks at the actions.
06:05 So, pass rule will get the highest priority
06:08 followed by the drop rules, and then alert rules.
06:11 And then within every rule groups, like for example,
06:14 you have five pass rules,
06:17 then the priority of those rules will be looked at, right?
06:19 So, it's a two level of the, you know,
06:22 the ordering that it follows.
06:23 So, the behavior of stateful rule group
06:26 is similar to security group,
06:28 but as you might have understood already,
06:30 it's much more intelligent than the security groups.
06:32 So, one thing to understand,
06:36 by default, the stateful rule groups engine
06:38 allows all traffic to pass.
06:41 It's not like a security group
06:42 that there is no inbound rule by default,
06:44 but for example, you just create the stateful rule groups
06:46 and you don't add any rule.
06:50 Ultimately, that traffic will be allowed, right?
06:52 So, that's different than the security group.
6. Domain List Rule 用 HTTP Host/TLS SNI Allow 或 Deny Domain
时间范围：06:54–08:08
总结 / Summary
中文
Stateful Domain List 可建立 Allowlist 或 Denylist。Allowlist 模式下，未匹配允许 Domain 的相关 Traffic 会被拒绝；Denylist 只 Block 指定 Domain。Target 可是 example.com，也可用以点号开头的 .example.com 匹配该域及 Subdomain。HTTP 从 Host Header 识别 Domain；HTTPS 因 Payload 加密，使用 TLS Handshake 中可见的 Server Name Indication（SNI）。这不是完整 TLS Payload Inspection。
English
Stateful domain lists implement allowlists or denylists. In allowlist mode, relevant traffic not matching an allowed domain is rejected; a denylist blocks only listed domains. Targets can be example.com or use a leading-dot form such as .example.com to include the domain and its subdomains. HTTP matching reads the Host header, while HTTPS uses Server Name Indication visible in the TLS handshake because the payload is encrypted. This is not full TLS payload inspection.
Transcript
06:54 Now, let's look at the stateful rule groups.
06:58 5-tuple rule you already know it's similar to the stateless.
07:01 And there is also a domain list rules.
07:05 Or it means that you can write both allow and deny list
07:08 of the domain names.
07:11 So, you can actually whitelist or blacklist
07:12 the domain names using these rules.
07:15 So, if you allow rules,
07:18 and if none of the specification matches the domain name,
07:19 ultimately, the traffic is denied.
07:24 And deny is for blocking the particular domain name.
07:27 And match settings, you can provide the domain list.
07:30 For example, example.com, or you can use wildcard
07:34 as a forced character.
07:37 That means .example.com,
07:39 but you cannot use example.something.com, right?
07:41 The dot should be the first character.
07:46 And protocol, it supports its HTTP and HTTPS.
07:48 So, for HTTPS traffic, as you know,
07:52 it's an encrypted traffic.
07:54 So, it uses the SNI, server name indication,
07:56 so that it knows that what is the domain name it is using
07:59 as a part of SNI.
08:02 So, this is how it works.
08:02 And in case of HTTP traffic,
08:05 it uses just plain headers to get the domain name.
7. Suricata Signature 由 Action、Header 与 Options 组成
时间范围：08:08–09:02
总结 / Summary
中文
Suricata-compatible Rule 用 Signature 描述 Threat/Traffic Pattern。Action 决定 Match 后 Pass、Drop 或 Alert；Header 描述 Protocol、Source/Destination Address、Port 与 Direction；Options 再表达 Content、Message、Flow、Signature ID 等更细条件。课程不要求掌握全部 Suricata Syntax，但要能识别 Rule 结构，并理解 Network Firewall 可复用 Open-source IDS/IPS Format。
English
A Suricata-compatible rule uses a signature to describe a threat or traffic pattern. The action determines pass, drop, or alert on a match; the header specifies protocol, source and destination addresses and ports, and direction; options add details such as content, message, flow, and signature ID. The course does not require mastery of all Suricata syntax, but candidates should recognize the structure and understand that Network Firewall reuses an open-source IDS/IPS format.
Transcript
08:08 Next is the Suricata rule that it supports.
08:11 Now, this is the most important one.
08:15 Now, understanding Suricata rules in detail
08:17 is out of scope for this course.
08:19 And I would request to just go to this open source document
08:22 and read more about it.
08:26 But ultimately, every rule consist of the signature.
08:28 Signature means you are writing the rules to, you know,
08:31 avoid some attacks, right?
08:34 So, what's that attack signature, right?
08:36 That you define in the rule.
08:38 So, again, in Suricata rules,
08:41 you have actions which tells what to do
08:42 when the packet matches that signature.
08:45 The action could be again pass, or drop, or alert.
08:48 Now, signature would also have header
08:52 which defines which protocol it is, IP addresses, ports,
08:55 and direction of the traffic.
08:58 And then also there is a additional options
08:59 that you can define in this rules.
8. Suricata Header：Protocol、Variables、Ports 与 Direction Operator
时间范围：09:02–10:22
总结 / Summary
中文
示例 Signature 以 Action 开头，Header 中的 tcp 是 Protocol；$HOME_NET 与 $EXTERNAL_NET 是可在 Rule Variable 中集中配置的 Address Set，避免逐条修改 Signature；any 或具体 Range 定义 Port；Direction 支持单向 -> 或双向 <>。Header 后的 Parenthesized Options 定义 msg、flow、content、sid、rev 等检测逻辑与元数据。变量与版本化 Signature 便于统一维护 Rule Feed。
English
The example signature begins with an action. In its header, tcp is the protocol; $HOME_NET and $EXTERNAL_NET are centrally configured address variables that avoid editing every signature; any or ranges define ports; and direction uses one-way -> or bidirectional <>. Parenthesized options then define detection logic and metadata such as msg, flow, content, sid, and rev. Variables and versioned signatures make rule feeds easier to maintain consistently.
Transcript
09:02 So, just an example, this is one of the rule.
09:05 And if you look at this rule, there are various components.
09:08 So, the first in red that you see is basically an action.
09:11 Then comes the header, that's all this green part,
09:17 and it defines the protocol, the source IP address range,
09:19 source port range, destination IP address range,
09:23 and destination.
09:26 Then there is an options.
09:28 Now, if you look at this very closely,
09:30 the protocol is here, TCP.
09:32 And then you see these two things,
09:35 $HOME_Net and $EXTERNAL_NET.
09:36 Now, these are basically the variables that you can use
09:39 in your configuration file of Suricata rules
09:42 so that you don't have to really modify your rules directly,
09:45 but you just add those IP address ranges
09:49 to this two variables,
09:51 and then it will automatically dissolve runtime.
09:53 And then there is port as well.
09:57 You can define any,
09:59 or you can define those specific port range here.
10:01 And finally, there is a direction which says
10:04 in which direction we want to apply this rule into
10:07 and only supported arrows are right arrow.
10:10 And you know, both these arrows that use the rule
10:13 will be evaluated for both the traffic coming in
10:17 and going out, or a written traffic.
10:19 So, this is how the Suricata rule signature looks like.
9. Evaluation Order 决定是否跳过 Stateful Engine 与后续 Rule
时间范围：10:22–12:32
总结 / Summary
中文
Packet 经 Firewall Endpoint 后先进入 Stateless Engine。Stateless Pass 会立即进入 VPC 并跳过剩余 Stateless/Stateful Rule；Drop 立即丢弃；Forward 才进入 Stateful Engine。Stateful Engine 再按所选 Rule Order 评估，产生 Pass、Drop 或 Alert；Alert 通常记录 Event 供后续分析，并不等同于 Block。Outbound Flow 同样反向经过 Endpoint 与这两个 Engine。排错时必须确认究竟在哪个阶段提前终止了 Evaluation。
English
After a packet reaches the firewall endpoint, it enters the stateless engine first. Stateless pass sends it into the VPC immediately and skips remaining stateless and stateful rules; drop discards it; only forward enters the stateful engine. Stateful evaluation then follows the selected rule order and produces pass, drop, or alert. Alert normally records an event for analysis and does not itself mean block. Outbound flows traverse the same engines in the reverse path. Troubleshooting must identify the stage where evaluation terminated.
Transcript
10:22 And finally,
10:26 if you look at the evaluation order of your rule,
10:28 you understood that incoming packet
10:31 will be forced intercepted by network firewall endpoint.
10:33 If it allows, then it is passed.
10:37 Otherwise, the packet will be dropped.
10:39 And same applies to the outbound traffic
10:41 from your machine to the outside world.
10:43 Now, if you look at closely to the rule engine
10:46 consists of two types of the rule as you understood,
10:49 the stateless rule groups and the stateful rule groups.
10:51 The same has been shown here.
10:55 Incoming packet will first get
10:57 into the stateless rule engine.
10:59 And then according to the priority of your rules,
11:01 they will be evaluated.
11:04 Any matching rule, it will take an action.
11:06 Action can define on the rule level,
11:08 whether you want to pass that traffic.
11:10 In that case, rest of the rules are skipped, right?
11:11 Then it doesn't go into the stateful firewall
11:16 or any other rules if there is a match.
11:18 And if the action is pass,
11:20 the packet will be directly go into your VPC.
11:22 But if the action is dropped
11:26 then packet will be dropped there,
11:28 and then no further evaluation would happen.
11:29 And in certain cases,
11:32 you want to just pass it to the stateful firewall.
11:33 In that case, it will be routed here.
11:35 Now, in stateful firewall as well,
11:38 rule processing will happen according to the action force.
11:40 That means force the pass rules will be evaluated
11:42 then the drop rules and then all alert rules, right?
11:45 And if there are multiple rules inside the pass action,
11:48 then of course the rule priority will be looked at again.
11:51 And in case of stateful engine, again,
11:55 the action could be pass, or drop, or alert.
11:58 Now, alert is something like, you know,
12:01 you can log that entry so that later you can analyze
12:03 what traffic was, you know, dropped or passed
12:06 in my stateful rule engine.
12:09 So, this is how the traffic flow looks like
12:12 while using the AWS network firewall.
12:15 And now, we will see AWS network firewall in action,
12:18 where we'll set up few rules in the form of stateless
12:21 and stateful rules.
12:24 And we'll see how the traffic is allowed
12:25 or denied in that case.
12:27 So, thanks for watching.
整讲总结 / Overall Summary
中文
AWS Network Firewall 的配置层次是 Firewall → Firewall Policy → Stateless/Stateful Rule Group。Packet 先过 Stateless Priority Rule 与 Default Action，只有 Forward 才进入 Stateful Engine；Stateful 可用 5-Tuple、Domain List 与 Suricata Signature。掌握 Stateless Action、Stateful Order、HTTP Host/TLS SNI Domain Matching、Suricata Action/Header/Options，以及 Pass/Drop/Alert 对 Evaluation Flow 的终止效果，是后续实操与考试的核心。
English
AWS Network Firewall configuration follows Firewall → Firewall Policy → stateless and stateful rule groups. Packets encounter stateless priority rules and a default action first, and only forwarded packets reach stateful inspection. Stateful rules can use five tuples, domain lists, and Suricata signatures. The essential concepts are stateless actions, stateful rule order, HTTP Host and TLS SNI domain matching, Suricata action-header-options structure, and how pass, drop, or alert affects evaluation flow.
返回顶部 ↑