How do I configure Network Firewall standard rule groups and domain list rule group rules together?

Short description

Configure standard rule group rules to drop established TCP traffic. Then configure domain list rule group rules to allow the TCP (TLS) flows sent to allowed domains from the domain list rule group. To do this, configure a domain list rule group and standard rule group rules with a flow keyword.

This article uses one of the distributed deployment models. This model protects traffic between a workload public subnet with a client Amazon Elastic Compute Cloud (Amazon EC2) instance and an internet gateway. The firewall policy rule order is set to default action order.

Note: The Amazon Virtual Private Cloud (Amazon VPC) console displays only previously configured rule options. It doesn't allow you to add rule options. For more information, see Standard stateful rule groups in AWS Network Firewall.

Use AWS CloudFormation or an API to specify rule options for your standard rule group rules. The examples in this article use AWS Command Line Interface (AWS CLI).

Resolution

Note: If you receive errors when you run AWS CLI commands, then see Troubleshooting errors for the AWS CLI. Also, confirm that you're using the most recent AWS CLI version.

Prerequisites

Confirm that the Amazon EC2 instance is allowed to send traffic on TCP port 443 in the VPC security group and network ACL.

Note: In the code examples in this article, ellipses (...) shorten outputs.

Configure a domain list rule group and standard rule group without a flow keyword

When you configure a domain list rule group and standard rule group, your configuration can be similar to the one in this example. If you create a domain list rule group and standard rule group, then you must use a flow keyword. If you don't use a flow keyword, then you might encounter problems such as the one in this example.

In the following example, the Amazon VPC console creates a domain list rule group. The rule allows HTTPS traffic to example.com:

Domain name source: example.com
Source IPs type: Default
Protocol: HTTPs
Action: Allow

Note: A domain list rule group with the action set to Allow generates another rule. The rule denies traffic of the specified protocol type that doesn't match the domain specifications. For more information, see Domain filtering.

The Amazon VPC console creates a standard rule group rule with the following configuration: protocol TCP, source Any, destination Any, source port Any, destination port Any, direction Forward, and action Drop.

When you send a request to an allowed domain to test your rule configuration, the traffic is blocked and you receive a "connection timed out" error:

curl -kv -so /dev/null https://example.com
* Trying [IP_ADDRESS]...
* connect to [IP_ADDRESS] port 443 failed: Connection timed out
* Failed to connect to example.com port 443 after 129180 ms: Connection timed out
* Closing connection 0

The configuration causes all TCP traffic to drop and the connection to time out. This includes blocking TCP-based traffic to the allowed domain example.com.

The domain list rule group rule to allow example.com over HTTPS fails because TCP is the first protocol to appear in the initial flow. The flow starts with the lower-layer TCP handshake and the deny rule is evaluated. At that point, there is no TLS protocol to match, so the drop rule matches. This causes all traffic to example.com to drop.

Note: You can configure log levels for your firewall's stateful engine to access detailed information about filtered traffic. For more information, see Logging network traffic from AWS Network Firewall.

Configure a domain list rule group and standard rule group rule with a flow keyword

Use the Network Firewall describe-rule-group and update-rule-group commands to update your standard rule group rules to include an additional flow keyword.

1. To retrieve the UpdateToken value for the stateful rule group, run the following describe-rule-group AWS CLI command:

   aws network-firewall describe-rule-group --rule-group-arn "arn:aws:network-firewall:us-east-1:111122223333:stateful-rulegroup/stateful-rg-5-tuple" --output json
   

   Note: Replace 111122223333 with your AWS account ID. Replace stateful-rg-5-tuple with your rule group name. Part of the output from this command is used as a JSON template for other adjustments later.

   The output looks similar to the following:

   {
       "UpdateToken": "40b87af5-a20c-4f8c-8afd-6777c81add3c",
       (...)
           "RulesSource": {
               "StatefulRules": [{
                   "Action": "DROP",
                   "Header": {
                       "Protocol": "TCP",
                       "Source": "Any",
                       "SourcePort": "Any",
                       "Direction": "FORWARD",
                       "Destination": "Any",
                       "DestinationPort": "Any"
                   },
                   "RuleOptions": [{
                       "Keyword": "sid",
                       "Settings": [
                           "5"
                       ]
                   }]
               }]
           }
       (...)
   }
   

2. To verify the JSON rule file content, create a JSON rule file with a modified rule configuration and run the following command:

   cat tcp-drop-rule-updated.json
   {
     "RulesSource": {
       "StatefulRules": [
         {
           "Action": "DROP",
           "Header": {
             "Direction": "FORWARD",
             "Protocol": "TCP",
             "Destination": "Any",
             "Source": "Any",
             "DestinationPort": "Any",
             "SourcePort": "Any"
           },
           "RuleOptions": [
             {
               "Keyword": "sid",
               "Settings": [
                 "5"
               ]
             },
             {
               "Keyword": "flow",
               "Settings": [
                 "established, to_server"
               ]
             }
           ]
         }
       ]
     }
   }
   

   In this example, the flow keyword allows the TCP handshake to complete before the TCP drop rule is evaluated when you send a request to example.com. After this, the rule default action order takes precedence. The domain list allow HTTPS rule for example.com matches, allowing the rest of the traffic through for that flow. Any traffic to domains that aren't allowed is blocked, as well as any other established TCP traffic.

3. To update the standard rule group, run the following update-rule-group AWS CLI command using the UpdateToken value and JSON rule file:

   aws network-firewall update-rule-group --rule-group-arn "arn:aws:network-firewall:us-east-1:111122223333:stateful-rulegroup/stateful-rg-5-tuple" --update-token 40b87af5-a20c-4f8c-8afd-6777c81add3c --rule-group file://tcp-drop-rule-updated.json --output json
   

   Note: Replace 111122223333 with your AWS account ID. Replace stateful-rg-5-tuple with your rule group name. Replace 40b87af5-a20c-4f8c-8afd-6777c81add3c with the UpdateToken value from step 1.

   The result looks similar to this output:

   {
       "UpdateToken": "bf8fe6d4-f13e-406c-90c1-9e3bad2118a7",
       "RuleGroupResponse": {...},
           "LastModifiedTime": "2023-02-07T14:12:14.993000+11:00"
       }
   }
   

4. To verify the changes to the stateful rule group, run the following describe-rule-group AWS CLI command:

   aws network-firewall describe-rule-group --rule-group-arn "arn:aws:network-firewall:us-east-1:111122223333:stateful-rulegroup/stateful-rg-5-tuple" --output json
   

   Note: Replace 111122223333 with your AWS account ID and stateful-rg-5-tuple with your rule group name.

   The output looks similar to the following:

   {(...)
           "RulesSource": {
               "StatefulRules": [
                   {
                       "Action": "DROP",
                       "Header": {
                           "Protocol": "TCP",
                           "Source": "Any",
                           (...)
                       },
                       "RuleOptions": [
                           {
                               "Keyword": "sid",
                               "Settings": [
                                   "5"
                               ]
                           },
                           {
                               "Keyword": "flow",
                               "Settings": [
                                   "established, to_server"
                              ]
              (...)
           }
       },
       "RuleGroupResponse": {...},
           "LastModifiedTime": "2023-02-07T14:12:14.993000+11:00"
       }
   }
   

   Note: In the preceding output, established, to_server reflects the change from the update-rule-group command.

5. To verify that both the domain list rule group and standard rule group filter traffic correctly, run the following command:

   curl -kv -so /dev/null https://example.com
   *   Trying [IP_ADDRESS]...
   * Connected to example.com ([IP_ADDRESS]) port 443 (#0)
   (...)
   > GET / HTTP/1.1
   > Host: example.com
   (...)
   
   < HTTP/1.1 200 OK
   (...)
   

   The output shows that HTTPS traffic to the allowed domain example.com succeeds, as configured.

   In this next example, HTTPS traffic to domains that aren't allowed is blocked, as expected:

   curl -m 5 -kv -so /dev/null https://www.amazon.com
   *   Trying [IP_ADDRESS]...
   * Connected to www.amazon.com ([IP_ADDRESS]) port 443 (#0)
   (...)
   * TLSv1.2 (OUT), TLS handshake, Client hello (1):
   (...)
   * Operation timed out after 5000 milliseconds with 0 out of 0 bytes received
   * Closing connection 0
   

Optionally, to verify that other established TCP traffic is also blocked, run the following s3 ls AWS CLI command:

aws s3 ls --cli-read-timeout 30 --debug

Related information

Hands-on walkthrough of the AWS Network Firewall flexible rules engine – Part 1