What is AWS Network Firewall?
AWS Network Firewall is a stateful, managed firewall and intrusion detection/prevention service for Amazon VPC. It filters traffic at the perimeter of the VPC, including traffic to and from an internet gateway, NAT gateway, or over VPN or AWS Direct Connect. For stateful inspection, the service uses the open source IPS Suricata and supports Suricata-compatible rules.
Network Firewall can be used to allow traffic only to known AWS service domains or endpoints, enforce custom lists of known malicious domains, perform deep packet inspection on incoming and outgoing traffic, and detect and filter protocols such as HTTPS regardless of the port used. The service is supported by AWS Firewall Manager, which allows central management of firewalls across multiple accounts in AWS Organizations.
Core Features
- Stateful Inspection: Connection tracking across the entire traffic flow
- Intrusion Prevention: Suricata-compatible rules for deep packet inspection
- Domain Filtering: Filtering based on SNI and HTTP host headers
- TLS Inspection: Optional decryption and inspection of HTTPS traffic (billed separately)
- AWS Firewall Manager: Central policy management across multiple accounts
Typical Use Cases
Central VPC Inspection: In hub-and-spoke architectures, Network Firewall filters traffic between VPCs and to the internet, with central policies simplifying compliance.
Malware Protection: AWS Managed Rules and partner-managed rule groups help detect known threat patterns; optional TLS inspection enables analysis of encrypted traffic as well.
Compliance Logging: Connections can be logged and streamed to destinations such as CloudWatch, S3, or Kinesis Data Firehose, for example for further processing in SIEM systems.
Benefits
- Firewall functionality without managing your own infrastructure
- Updatable rule sets via AWS Managed Rules and marketplace partners
- Central management across multiple VPCs and accounts
- Integration with AWS Organizations for multi-account management
Integration with innFactory
As an AWS Reseller, innFactory supports you with AWS Network Firewall: We help with network architecture design, Suricata rule development, and migration from on-premises firewalls.
Available Tiers & Options
Standard Protection
- Stateful inspection
- Domain filtering
- Protocol detection
- Additional costs for data processing
IPS with AWS Managed Rules
- Suricata-compatible IPS rules
- Automatic updates by AWS or marketplace partners
- Additional costs for managed rule groups or advanced threat protection
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is AWS Network Firewall?
AWS Network Firewall is a stateful, managed network firewall and intrusion detection/prevention service for VPCs. It filters traffic at the perimeter of the VPC, such as at an internet gateway, NAT gateway, or over VPN/Direct Connect, using the open source IPS Suricata for stateful inspection.
When should I use Network Firewall instead of Security Groups?
Network Firewall is suited for intrusion prevention with Suricata-compatible rules, domain-based filtering, central policies across multiple VPCs, and compliance requirements with central logging. Security Groups remain responsible for instance-level access control.
Which rule types are supported?
Network Firewall supports stateless rules for fast 5-tuple filtering and stateful rules that consider the context of an entire traffic flow. Stateful rules can also be written as Suricata-compatible rules for deep packet inspection.
How much does AWS Network Firewall cost?
An hourly rate applies per firewall endpoint (per region and Availability Zone), plus a charge per gigabyte of data processed. Add-ons such as TLS inspection, advanced threat protection, and managed rule groups from marketplace partners are billed separately. Current prices are listed on the official pricing page.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of AWS (official documentation). This page does not represent an offer by AWS.