AWS Network Firewall (NFW) Fine Grained Controls | Overview.

AWS Network Firewall (NFW)  Fine Grained Controls - Overview.

Scope:

• Overview of Network Firewalls,
• Fine-Grained Controls,
• Mechanisms for Fine-Grained Controls,
• Logging and Visibility,
• Implementation Patterns (AWS Sample),
• Best Practices,
• Benefits of Fine-Grained Controls.

1. Overview of Network Firewalls

•   AWS network firewall (NFW) is a security layer controlling traffic flow between networks.
•  Network firewalls (NFW) operate at:
• The perimeter 
• Subnet level to enforce network-wide policies.

Key capabilities:

•  Stateful inspection: Tracks connection states (TCP, UDP sessions).
•  Stateless inspection: Simple packet filtering based on rules.
•  Logging and alerting: Monitor allowed/denied traffic.
• Threat protection: Detects malicious traffic patterns, exploits, or anomalies.

2. Fine-Grained Controls

• “Fine-grained controls” refer to highly specific rules that dictate traffic behavior based on multiple attributes.
• This Fine-grained controls allows precise segmentation, threat mitigation, and compliance enforcement.

Typical attributes you can control:

Attribute	Example Control
Source/Destination IP	Allow only 10.0.0.0/24 → 172.16.0.0/24
Protocol / Port	Allow TCP 443, Block TCP 22
Domain Names / URLs	Allow *.example.com, Block *.malware.com
Traffic direction	Inbound vs outbound
Stateful session context	Allow established connections, deny new unsolicited connections
Application layer filtering	HTTP method restrictions, SQLi detection
Time-based rules	Allow access only during office hours

NB:

• Fine-grained control lets twtech to:
• implement least-privilege network access, 
• reduce attack surface, 
• enforce compliance like PCI DSS or HIPAA.

3. Mechanisms for Fine-Grained Controls

a) Rule Groups

•         Group rules into logical sets (allow, deny, logging).
•         Can be stateful (track connection) or stateless (individual packet filtering).
•         Example: AWS Network Firewall uses:
•    Stateless rule groups → Fast, simple filtering.
•    Stateful rule groups → Deep inspection, tracking flows.

b) Rule Priority and Evaluation

•         Fine-grained control requires rule ordering and evaluation logic:

1.     Stateless rules evaluated first.
2.     Stateful rules evaluated per session.
3.    Default action applied if no rules match.

•         Helps prevent rule shadowing (where a general rule overrides a specific one).

c) Domain Name / URL Filtering

• Using DNS inspection for outbound traffic control.
• Example: Block *.malware.com while allowing *.twtechapp.com.
• Works well with proxy integration or inline firewall deployment.

d) Application Layer Inspection

•  Deep Packet Inspection (DPI) allows the firewall to examine HTTP headers, SSL SNI, or even content patterns.
•  Example: Detect SQL injection attempts in HTTP POST requests.

e) Threat Intelligence Integration

•  Firewalls can ingest IP reputation lists, known malicious domains, or intrusion signatures.
•  Enables dynamic blocking rather than static rules.

4. Logging and Visibility

• Fine-grained control is useless without visibility.
•  Logging options usually include:

Feature	Details
Flow logs	Capture accepted/denied traffic metadata
Alerting	Trigger SNS, CloudWatch, or SIEM alerts
Packet capture	Optional deep-dive for forensic analysis

5. Implementation Patterns (AWS Sample)

AWS Network Firewall provides:

• VPC level deployment: Firewall sits in a dedicated subnet (inspection VPC).
• Route tables: Direct traffic through the firewall (inline).
• Policy structure:
•    Firewall policy → References stateful/stateless rule groups.
•    Rule groups → Contain specific match conditions.
•    Logging → CloudWatch Logs or S3 for analytics.

Fine-grained example:

• Deny all outbound connections to *.torrent domains.
• Allow HTTPS only to api.company.com.
• Deny inbound SSH from outside trusted IP ranges.

6. Best Practices

1.  Start with a default deny policy, then allow exceptions.
2.  Segment by trust level: DMZ, internal workloads, sensitive data.
3.  Use stateless + stateful rules wisely: stateless for high-performance filtering, stateful for complex session inspection.
4.  Test rules in a staging VPC before production.
5.  Enable logging for all traffic and integrate with SIEM.
6.  Review and rotate rules periodically for least-privilege enforcement.

7. Benefits of Fine-Grained Controls

•  Reduced attack surface: Blocks unnecessary traffic.
•  Compliance adherence: Supports regulatory audits.
•  Dynamic threat mitigation: Can integrate threat intel for real-time protection.
•  Better performance: Offloads filtering from hosts to dedicated firewalls.