Help with AWS Network firewall rule

0

I have a requirement to create below rule in AWS network firewall. I am not sure if this is supported given the destination ports are non standard (i.e. not 80/.443). and if supported can this be stateful rule and if so how?

Source - IP address of an EC2 (x.x.x.x/32) Destination domain: .example.com
Destination port range: 5661-5662

Destination IP is unknown or keeps changing.

Any guidance here will be greatly appreciated.

Purpose for this type of request:

We have a requirement to enable a Microsoft PowerBI related domain from an EC2 which would contain Microsoft On-premises Data Gateway. This domain needs access to non standard ports other than 443. Due to data sensitivity, we are mandated to only allow outbound access from EC2 to specific domain/port and block everything else. Hence looking for a solution to define a AWS NW FW rule which caters to this specific requirement.

  • Can you please add a the purpose behind this, asking so as to be able to recommend in a better way.

  • HI there, I might be able to help you here. Can you confirm if the traffic or packets are HTTP-based? Doesn't matter if its not going through standard ports as Suricata is able to inspect packets up to Layer 7. If it's not HTTP, which protocol is it using to establish the connection? Thanks, Carlos

asked 2 years ago701 views
1 Answer
0

You could look into using suricata based rules like this example for domain filtering.

You could also do it with 5-tuple settings being constantly updated by a lambda function that checks the IP for a domain and updates the Network Firewall Rule

AWS
answered 2 years ago
  • Hi Pablo, thanks for the response. I am keeping 5-tuple/lambda option as a last resort.

    Are you able to help with a Suricata based rule for my example (pasted again below)? I am not sure how to use/pass port details. Or point me to any examples. The link which you have posted above (which I had seen) doesn't provide this information

    Source - IP address of an EC2 (x.x.x.x/32) Destination domain: .example.com Destination port range: 5661-5662 Type of rule: ALLOW

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions