AWS Firewall - Blocking internet traffic with exceptions

Question

Hello all, wondering if you can help. I have an AWS Firewall and NAT gateway implemented to allow egress internet access to the EC2 instances I manage. I created some firewall rules to block traffic to all but a few websites however, they do not appear to be working as expected.

Following https://aws.amazon.com/blogs/desktop-and-application-streaming/filtering-internet-traffic-from-amazon-workspaces/ I have done the following.

**Firewall Rules**
Stateless Rule 1
TCP - source 0.0.0.0/0 - destination 0.0.0.0/0 - Any port - Pass - This allows internet if used

However, if I change it to the following, the internet stops working.

Stateless Rule 1
TCP - source 0.0.0.0/0 - destination 0.0.0.0/0 - Any port - forward to stateful

Stateful Rule 1
URL 
google.com
amazonaws.com 
Inspect HTTP and HTTPS - Action Allow - No internet

Cloudwatch logs show the following

{
    "firewall_name": "FIREWALL",
    "availability_zone": "xxxxxxxx",
    "event_timestamp": "TIME",
    "event": {
        "app_proto": "tls",
        "src_ip": "FIREWALL IP",
        "src_port": 43973,
        "event_type": "alert",
        "alert": {
            "severity": 3,
            "signature_id": 5,
            "rev": 0,
            "signature": "aws:alert_established action",
            **"action": "blocked",**
            "category": ""
        },
        "flow_id": 737098114964242,
        "dest_ip": "52.94.50.18",
        "proto": "TCP",
        "tls": {
            "sni": "ssm.DESTINATION.amazonaws.com",
            "version": "UNDETERMINED",
            "ja3": {},
            "ja3s": {}
        },
        "dest_port": 443,

Arun Kadian · Answer

Maybe try this -

1/ Remove the Allow-All Rule.

2/ Instead of a single "allow all" rule, create explicit rules to allow traffic to the specific websites you want (e.g., Google and Amazon). These rules should be placed above the blocking rule.

3/  Now, create your blocking rule to inspect traffic for all destinations except those allowed explicitly in the previous step.

By removing the "allow all" rule and creating specific allow rules first, you ensure that only traffic destined for the specified websites is allowed.
The blocking rule with inspection will then block all other traffic by default, achieving the desired behavior.

AWS Firewall - Blocking internet traffic with exceptions

Add your answer

Relevant content