Stateful Rule Groups and Suricata Rules

Network Firewall organizes rules into rule groups, which are either stateless or stateful. Stateless groups apply fast, connectionless packet rules; stateful groups track connection state and run deeper, signature-based inspection. A firewall policy references both kinds.

Stateless rule groups evaluate each packet independently on basic attributes like source, destination, port, and protocol, then pass, drop, or forward to stateful inspection. They are fast and cheap, ideal for coarse filtering before the deeper stateful engine examines what remains.

Stateful rule groups understand connections and can match on protocol behavior, domains, and threat signatures. They are where advanced detection lives, supporting three formats: 5-tuple rules, domain-list rules, and Suricata-compatible rules. This is the heart of Network Firewall intrusion prevention.

5-tuple stateful rules match on protocol, source and destination IP, and source and destination port, with a direction and action (pass, drop, alert). They resemble traditional firewall rules but run in the stateful engine, so they understand established connections.

Domain-list rules allow or deny traffic based on the destination domain name, inspecting the SNI in TLS or the Host header in HTTP. This is the simplest way to build domain allow-lists or deny-lists for egress control without writing complex signatures.

Network Firewall accepts open-source Suricata intrusion detection rule syntax, a widely used IDS/IPS standard. This lets you reuse community and commercial threat signatures to detect malware, exploits, and protocol anomalies, bringing mature IPS capability into your AWS VPC.

Stateful rule actions include pass (allow and stop further stateful evaluation), drop (silently discard), alert (log without blocking, like WAF count), and reject (drop and send a TCP reset). Alert mode is invaluable for testing signatures before enforcing them.

You can set the stateful engine to evaluate rules by default action order or strict order. Strict order lets you control precedence precisely and set a default drop, which is essential for a deny-by-default egress policy where only explicitly permitted traffic passes.

AWS offers managed rule groups for Network Firewall containing curated, regularly updated threat signatures (for example, against known malware command-and-control and botnets). Like WAF managed rules, they let you adopt expert-maintained protection without authoring every Suricata rule yourself.

Stateful rules that use the alert action write to the firewall alert log, showing exactly which signature matched and the traffic involved. Reviewing alert logs is how you validate new rules, investigate suspicious traffic, and tune away false positives before switching alerts to drops.

A practical policy uses stateless rules for coarse pass/drop, a domain-list stateful group for egress allow-listing, and Suricata or managed signature groups for intrusion prevention, with strict order and a default drop. This layered rule design delivers both performance and depth.

Match the rule format to the need.

Network Firewall uses stateless (fast, per-packet) and stateful (connection-aware) rule groups. Stateful formats are 5-tuple, domain-list, and Suricata-compatible, with actions pass, drop, alert, and reject. Use strict rule order with a default drop for deny-by-default egress. AWS managed signature groups add curated threat detection, and alert logs let you test rules before enforcing them.