Using Stateful Domain List rule in Network Firewall

Hi Oluwakemi,

If the Stateful Default Actions are taking effect, it could indicate that your Domain List Rules aren't matching as expected. Be sure that you're using explicit names or names that contain a wildcard (".domainesample.com") appropriately. Domain List rules support either Allow or Deny. Here is a resource with guidance regarding Domain List rule matching: Match Settings

Additionally, here is a blog post that steps through a hands-on process of configuring Network Firewall evaluations and Strict Rule Order (which appears to be in use in your usecase): Hands-On Walkthrough

If you have enabled the stateful default drop established action with a domain allow list rule group and your pass http/pass tls rules are failing to match test traffic, the two most common causes are:

Asymmetric routing

Request traffic is forwarded to the firewall endpoint but response traffic is routed around it. The stateful engine (Suricata) only sees half the conversation and cannot observe the complete TCP 3-way handshake or application-layer exchange, preventing it from establishing flow state and matching application-layer rules.

Outbound (request) path:

• EC2 private subnet (0.0.0.0/0 → Firewall endpoint) → Firewall subnet (0.0.0.0/0 → NAT GW) → NAT GW public subnet (0.0.0.0/0 → IGW) → Internet

Inbound (response) path — must be symmetric:

• Internet → IGW → NAT GW public subnet (EC2 private CIDR → Firewall endpoint) → Firewall subnet (VPC local route → EC2)

The key is the static route in the NAT Gateway subnet: EC2 CIDR → Firewall endpoint. The firewall endpoint should be in the same availability zone as the NAT Gateway to avoid cross-AZ traffic. Without this route, response traffic bypasses the firewall and Suricata only sees half the conversation. Note that symmetric routing is a requirement for all Network Firewall deployment models — the example above is one common scenario, but the same principle applies regardless of your architecture.

HOME_NET rule variable misconfiguration

Domain allow list rule groups generate rules using HOME_NET for source and EXTERNAL_NET (everything outside HOME_NET) for destination. If HOME_NET does not include the source IP or CIDR of your client, the rules won't match. This is common in centralized firewall deployments using Transit Gateway where the source is in a spoke VPC and the firewall is in a central inspection VPC — by default, the firewall's HOME_NET only includes the CIDR of the VPC it was created in. You can update HOME_NET at the firewall policy level so all stateful rule groups that reference the variable inherit the change, or define the source CIDRs locally within the domain list rule group under the Source IPs section.

For reference, example domain list rules are available in the developer guide, and this knowledge center article walks through how to configure Network Firewall rules to block or allow specific domains.