Class: Aws::NetworkFirewall::Types::FirewallRule

Inherits:

Struct

• Object
• Struct
• Aws::NetworkFirewall::Types::FirewallRule

Defined in:

gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb

Overview

A single structured firewall engine rule, for use in a firewall engine rule group or as an embedded rule in a Next Generation policy. A firewall rule accepts, drops, or rejects traffic at a connection-state hook. For more information about authoring firewall engine rules, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide.

See Also:

• AWS API Documentation

Constant Summary

SENSITIVE =

[]

Instance Attribute Summary

• #accept_prior_hooks ⇒ Boolean

  Whether Network Firewall automatically accepts the earlier application-layer hooks that a connection must pass to reach this rule's hook.

• #action ⇒ String

  The action that the firewall engine takes on traffic that matches the rule.

• #action_scope ⇒ String

  The scope that controls how much of the matched traffic the action applies to.

• #alert_enabled ⇒ Boolean

  Specifies whether the rule also generates an alert log for the traffic that it matches.

• #bypass_ips_enabled ⇒ Boolean

  Specifies whether an accepted connection bypasses the IPS engine.

• #dest_i_ps ⇒ String

  The destination IP addresses and address ranges to inspect for, in CIDR notation.

• #dest_ports ⇒ String

  The destination ports to inspect for.

• #hook ⇒ String

  The connection-state hook at which the firewall engine evaluates the rule.

• #protocol ⇒ String

  The protocol of the rule's hook.

• #rule_metadata ⇒ Types::RuleMetadata

  Optional metadata for the rule: whether the rule is enabled and a description.

• #rule_options ⇒ Array<Types::RuleOption>

  Additional options for the rule.

• #source_i_ps ⇒ String

  The source IP addresses and address ranges to inspect for, in CIDR notation.

• #source_ports ⇒ String

  The source ports to inspect for.

Instance Attribute Details

#accept_prior_hooks ⇒ Boolean

Whether Network Firewall automatically accepts the earlier application-layer hooks that a connection must pass to reach this rule's hook. Because the firewall engine is drop by default, accepting prior hooks lets you author a single rule for the hook you care about, instead of also authoring a rule for each earlier hook. This setting accepts the earlier application-layer hooks only; it doesn't accept the TCP layer. For more information, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide.

Returns:

• (Boolean)

# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 5272

class FirewallRule < Struct.new(
  :action,
  :action_scope,
  :hook,
  :protocol,
  :source_i_ps,
  :dest_i_ps,
  :source_ports,
  :dest_ports,
  :rule_options,
  :accept_prior_hooks,
  :alert_enabled,
  :bypass_ips_enabled,
  :rule_metadata)
  SENSITIVE = []
  include Aws::Structure
end

#action ⇒ String

The action that the firewall engine takes on traffic that matches the rule. The firewall engine supports the following actions:

• ACCEPT - Allow the traffic.

• DROP - Block the traffic and discontinue inspection.

• REJECT - Block the traffic and send a TCP reset packet back to the client.

• REJECT_DST - Block the traffic and send a TCP reset packet to the destination.

• REJECT_BOTH - Block the traffic and send a TCP reset packet to both the client and the destination.

You combine the action with an action scope, for example accept:flow. To send accepted traffic straight to its destination and skip the IPS engine, pair an accept action with the BypassIPSEnabled setting. For more information, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide.

Returns:

• (String)

# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 5272

class FirewallRule < Struct.new(
  :action,
  :action_scope,
  :hook,
  :protocol,
  :source_i_ps,
  :dest_i_ps,
  :source_ports,
  :dest_ports,
  :rule_options,
  :accept_prior_hooks,
  :alert_enabled,
  :bypass_ips_enabled,
  :rule_metadata)
  SENSITIVE = []
  include Aws::Structure
end

#action_scope ⇒ String

The scope that controls how much of the matched traffic the action applies to. The valid scopes depend on the action: ACCEPT supports all four scopes, and DROP, REJECT, REJECT_DST, and REJECT_BOTH support only PACKET and FLOW.

• PACKET - The current packet only.

• HOOK - The current hook only. The firewall engine evaluates the connection again at the next hook.

• TX - The current transaction. The firewall engine continues to evaluate later transactions on the connection.

• FLOW - The entire connection. For an accept action, the connection skips the firewall engine's remaining hooks and advances to the IPS engine.

In a Suricata-compatible rule string, you write the scope in lowercase, for example accept:flow.

Returns:

• (String)

# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 5272

class FirewallRule < Struct.new(
  :action,
  :action_scope,
  :hook,
  :protocol,
  :source_i_ps,
  :dest_i_ps,
  :source_ports,
  :dest_ports,
  :rule_options,
  :accept_prior_hooks,
  :alert_enabled,
  :bypass_ips_enabled,
  :rule_metadata)
  SENSITIVE = []
  include Aws::Structure
end

#alert_enabled ⇒ Boolean

Specifies whether the rule also generates an alert log for the traffic that it matches. Turning on alerting adds a secondary alert action to the rule, so that Network Firewall logs the match in addition to taking the rule's primary action.

Returns:

• (Boolean)

# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 5272

class FirewallRule < Struct.new(
  :action,
  :action_scope,
  :hook,
  :protocol,
  :source_i_ps,
  :dest_i_ps,
  :source_ports,
  :dest_ports,
  :rule_options,
  :accept_prior_hooks,
  :alert_enabled,
  :bypass_ips_enabled,
  :rule_metadata)
  SENSITIVE = []
  include Aws::Structure
end

#bypass_ips_enabled ⇒ Boolean

Specifies whether an accepted connection bypasses the IPS engine. By default, traffic that the firewall engine accepts advances to the IPS engine for threat inspection. When you turn on this setting for an accept rule, the accepted traffic goes straight to its destination without IPS inspection. You can set the bypass only on accept rules, and it uses the same scope as the rule's accept action; only the flow and packet scopes support a bypass. For more information, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide.

Returns:

• (Boolean)

# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 5272

class FirewallRule < Struct.new(
  :action,
  :action_scope,
  :hook,
  :protocol,
  :source_i_ps,
  :dest_i_ps,
  :source_ports,
  :dest_ports,
  :rule_options,
  :accept_prior_hooks,
  :alert_enabled,
  :bypass_ips_enabled,
  :rule_metadata)
  SENSITIVE = []
  include Aws::Structure
end

#dest_i_ps ⇒ String

The destination IP addresses and address ranges to inspect for, in CIDR notation. A firewall rule always compiles to a forward-direction rule, so you express inbound compared to outbound traffic through the source and destination addresses.

Returns:

• (String)

# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 5272

class FirewallRule < Struct.new(
  :action,
  :action_scope,
  :hook,
  :protocol,
  :source_i_ps,
  :dest_i_ps,
  :source_ports,
  :dest_ports,
  :rule_options,
  :accept_prior_hooks,
  :alert_enabled,
  :bypass_ips_enabled,
  :rule_metadata)
  SENSITIVE = []
  include Aws::Structure
end

#dest_ports ⇒ String

The destination ports to inspect for.

Returns:

• (String)

# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 5272

class FirewallRule < Struct.new(
  :action,
  :action_scope,
  :hook,
  :protocol,
  :source_i_ps,
  :dest_i_ps,
  :source_ports,
  :dest_ports,
  :rule_options,
  :accept_prior_hooks,
  :alert_enabled,
  :bypass_ips_enabled,
  :rule_metadata)
  SENSITIVE = []
  include Aws::Structure
end

#hook ⇒ String

The connection-state hook at which the firewall engine evaluates the rule. The hook encodes both the protocol and the connection state, for example a TCP hook or a TLS client_hello hook. For the hooks that the firewall engine supports and how they map to the connection lifecycle, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide and the Suricata firewall mode documentation.

Returns:

• (String)

# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 5272

class FirewallRule < Struct.new(
  :action,
  :action_scope,
  :hook,
  :protocol,
  :source_i_ps,
  :dest_i_ps,
  :source_ports,
  :dest_ports,
  :rule_options,
  :accept_prior_hooks,
  :alert_enabled,
  :bypass_ips_enabled,
  :rule_metadata)
  SENSITIVE = []
  include Aws::Structure
end

#protocol ⇒ String

The protocol of the rule's hook. The protocol is derived from the hook and must match the hook's protocol prefix. Network Firewall rejects a rule whose protocol doesn't match its hook.

Returns:

• (String)

# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 5272

class FirewallRule < Struct.new(
  :action,
  :action_scope,
  :hook,
  :protocol,
  :source_i_ps,
  :dest_i_ps,
  :source_ports,
  :dest_ports,
  :rule_options,
  :accept_prior_hooks,
  :alert_enabled,
  :bypass_ips_enabled,
  :rule_metadata)
  SENSITIVE = []
  include Aws::Structure
end

#rule_metadata ⇒ Types::RuleMetadata

Optional metadata for the rule: whether the rule is enabled and a description. Metadata doesn't change how the rule matches or acts on traffic.

Returns:

• (Types::RuleMetadata)

# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 5272

class FirewallRule < Struct.new(
  :action,
  :action_scope,
  :hook,
  :protocol,
  :source_i_ps,
  :dest_i_ps,
  :source_ports,
  :dest_ports,
  :rule_options,
  :accept_prior_hooks,
  :alert_enabled,
  :bypass_ips_enabled,
  :rule_metadata)
  SENSITIVE = []
  include Aws::Structure
end

#rule_options ⇒ Array<Types::RuleOption>

Additional options for the rule. These are the Suricata RuleOptions settings, such as the signature ID (sid) and match keywords.

Returns:

• (Array<Types::RuleOption>)

# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 5272

class FirewallRule < Struct.new(
  :action,
  :action_scope,
  :hook,
  :protocol,
  :source_i_ps,
  :dest_i_ps,
  :source_ports,
  :dest_ports,
  :rule_options,
  :accept_prior_hooks,
  :alert_enabled,
  :bypass_ips_enabled,
  :rule_metadata)
  SENSITIVE = []
  include Aws::Structure
end

#source_i_ps ⇒ String

The source IP addresses and address ranges to inspect for, in CIDR notation. A firewall rule always compiles to a forward-direction rule, so you express inbound compared to outbound traffic through the source and destination addresses.

Returns:

• (String)

# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 5272

class FirewallRule < Struct.new(
  :action,
  :action_scope,
  :hook,
  :protocol,
  :source_i_ps,
  :dest_i_ps,
  :source_ports,
  :dest_ports,
  :rule_options,
  :accept_prior_hooks,
  :alert_enabled,
  :bypass_ips_enabled,
  :rule_metadata)
  SENSITIVE = []
  include Aws::Structure
end

#source_ports ⇒ String

The source ports to inspect for.

Returns:

• (String)

# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 5272

class FirewallRule < Struct.new(
  :action,
  :action_scope,
  :hook,
  :protocol,
  :source_i_ps,
  :dest_i_ps,
  :source_ports,
  :dest_ports,
  :rule_options,
  :accept_prior_hooks,
  :alert_enabled,
  :bypass_ips_enabled,
  :rule_metadata)
  SENSITIVE = []
  include Aws::Structure
end