Using Stateful Domain List rule in Network Firewall

Question

I have tried to use Domain list Stateful rule for my Network Firewall but it's either passed everything when default actions is DROP ESTABLISHED or dropped everything when default action is DROP ALL.

I will appreciate any pointers to what could be the reason for the domain list rule not to be working.

dustinhs · Answer

Hi Oluwakemi,

If the Stateful Default Actions are taking effect, it could indicate that your Domain List Rules aren't matching as expected.  Be sure that you're using explicit names or names that contain a wildcard (".domainesample.com") appropriately.
Domain List rules support either Allow or Deny.
Here is a resource with guidance regarding Domain List rule matching: [ Match Settings](https://docs.aws.amazon.com/network-firewall/latest/developerguide/stateful-rule-groups-domain-names.html#:~:text=be%20a%20match.-,Domain%20list,-%E2%80%93%20List%20of%20strings)

Additionally, here is a blog post that steps through a hands-on process of configuring Network Firewall evaluations and Strict Rule Order (which appears to be in use in your usecase):  [Hands-On Walkthrough](https://aws.amazon.com/blogs/security/hands-on-walkthrough-of-the-aws-network-firewall-flexible-rules-engine-part-2/)

Using Stateful Domain List rule in Network Firewall

Relevant content