What AWS Network Firewall Provides

AWS Network Firewall is a managed, stateful network firewall and intrusion prevention service for your VPC. Unlike security groups (per resource) or NACLs (per subnet), it provides deep, VPC-wide traffic inspection and filtering managed by AWS, scaling automatically with your traffic.

Security groups and NACLs filter on IP, port, and protocol only. Network Firewall adds deep packet inspection and can match on domain names, protocols, and attack signatures, giving you intrusion-prevention-style filtering inside the VPC that the simpler firewalls cannot provide.

Network Firewall has both a stateless engine for fast, simple packet rules and a stateful engine that tracks connections and runs deeper inspection. Stateless rules can quickly pass or drop traffic, while stateful rules apply Suricata-compatible signatures for advanced detection.

You deploy Network Firewall by creating firewall endpoints in dedicated subnets and routing traffic through them with route table changes. A common design uses a separate firewall subnet per Availability Zone, sending VPC traffic through the endpoint before it reaches the internet or other subnets.

Network Firewall fits patterns like centralized inspection using a transit gateway, or per-VPC inspection. Traffic from spoke VPCs can be routed through a central inspection VPC running the firewall, letting one policy guard many VPCs, which simplifies governance at scale.

As a managed service, Network Firewall handles scaling, patching, and availability for you. Deploying endpoints across multiple Availability Zones gives resilient, highly available inspection without you running and maintaining firewall appliances yourself.

A firewall policy defines the stateless and stateful rule groups, default actions, and behavior that a firewall enforces. One policy can be associated with multiple firewalls, centralizing your inspection rules much like a WAF web ACL centralizes web rules.

A major use case is egress (outbound) filtering: controlling which external domains and destinations your workloads may reach. This stops malware from calling home, blocks data exfiltration to unapproved sites, and enforces allow-lists of permitted destinations, which security groups cannot do by domain.

Network Firewall produces alert and flow logs that you send to CloudWatch Logs, S3, or Kinesis Firehose. Alert logs record traffic that triggered stateful rules; flow logs record connection metadata. These feed your detection and investigation tooling and provide an audit trail of inspected traffic.

Network Firewall is the AWS-native alternative to running third-party firewall appliances on EC2. It removes the burden of sizing, patching, and scaling instances while integrating with VPC routing and Firewall Manager for centralized, organization-wide deployment.

Use Network Firewall when you need VPC-wide intrusion prevention, domain-based egress control, or centralized inspection beyond what security groups and NACLs offer. It complements WAF (web requests) and Shield (DDoS), filling the deep network-inspection layer of your defense stack.

Identify the right tool.

AWS Network Firewall is a managed, VPC-wide stateful firewall and IPS with deep packet inspection beyond Layer 3/4. It runs stateless and stateful engines, deploys via firewall endpoints in dedicated subnets with route changes, and supports centralized inspection through transit gateways. Key uses are domain-based egress filtering and intrusion prevention, with alert and flow logging.