AWS re:Post을(를) 사용하면 다음에 동의하게 됩니다. AWS re:Post 이용 약관
AWS re:Postre:Post

Help with AWS Network firewall rule

0

I have a requirement to create below rule in AWS network firewall. I am not sure if this is supported given the destination ports are non standard (i.e. not 80/.443). and if supported can this be stateful rule and if so how?

Source - IP address of an EC2 (x.x.x.x/32) Destination domain: .example.com
Destination port range: 5661-5662

Destination IP is unknown or keeps changing.

Any guidance here will be greatly appreciated.

Purpose for this type of request:

We have a requirement to enable a Microsoft PowerBI related domain from an EC2 which would contain Microsoft On-premises Data Gateway. This domain needs access to non standard ports other than 443. Due to data sensitivity, we are mandated to only allow outbound access from EC2 to specific domain/port and block everything else. Hence looking for a solution to define a AWS NW FW rule which caters to this specific requirement.

  • Rishi
    일 년 전

    Can you please add a the purpose behind this, asking so as to be able to recommend in a better way.

  • CarlosGP-AWS
    일 년 전

    HI there, I might be able to help you here. Can you confirm if the traffic or packets are HTTP-based? Doesn't matter if its not going through standard ports as Suricata is able to inspect packets up to Layer 7. If it's not HTTP, which protocol is it using to establish the connection? Thanks, Carlos

주제
보안, 신원 및 규정 준수
태그
AWS 네트워크 방화벽
언어
English
AWSuser
질문됨 일 년 전480회 조회
1개 답변
0

You could look into using suricata based rules like this example for domain filtering.

You could also do it with 5-tuple settings being constantly updated by a lambda function that checks the IP for a domain and updates the Network Firewall Rule

AWS
Pablo Guzman
답변함 일 년 전
  • AWSuser
    일 년 전

    Hi Pablo, thanks for the response. I am keeping 5-tuple/lambda option as a last resort.

    Are you able to help with a Suricata based rule for my example (pasted again below)? I am not sure how to use/pass port details. Or point me to any examples. The link which you have posted above (which I had seen) doesn't provide this information

    Source - IP address of an EC2 (x.x.x.x/32) Destination domain: .example.com Destination port range: 5661-5662 Type of rule: ALLOW

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠