FirewallRule

A single structured firewall engine rule, for use in a firewall engine rule group or as an embedded rule in a Next Generation policy. A firewall rule accepts, drops, or rejects traffic at a connection-state hook. For more information about authoring firewall engine rules, see Rule groups for a firewall using a Next Generation policy in the AWS Network Firewall Developer Guide.

Action

The action that the firewall engine takes on traffic that matches the rule. The firewall engine supports the following actions:

ACCEPT - Allow the traffic.
DROP - Block the traffic and discontinue inspection.
REJECT - Block the traffic and send a TCP reset packet back to the client.
REJECT_DST - Block the traffic and send a TCP reset packet to the destination.
REJECT_BOTH - Block the traffic and send a TCP reset packet to both the client and the destination.

You combine the action with an action scope, for example accept:flow. To send accepted traffic straight to its destination and skip the IPS engine, pair an accept action with the BypassIPSEnabled setting. For more information, see Rule groups for a firewall using a Next Generation policy in the AWS Network Firewall Developer Guide.

Type: String

Valid Values: ACCEPT | DROP | REJECT | REJECT_DST | REJECT_BOTH

Required: Yes

ActionScope

The scope that controls how much of the matched traffic the action applies to. The valid scopes depend on the action: ACCEPT supports all four scopes, and DROP, REJECT, REJECT_DST, and REJECT_BOTH support only PACKET and FLOW.

PACKET - The current packet only.
HOOK - The current hook only. The firewall engine evaluates the connection again at the next hook.
TX - The current transaction. The firewall engine continues to evaluate later transactions on the connection.
FLOW - The entire connection. For an accept action, the connection skips the firewall engine's remaining hooks and advances to the IPS engine.

In a Suricata-compatible rule string, you write the scope in lowercase, for example accept:flow.

Type: String

Valid Values: FLOW | TX | HOOK | PACKET

Required: Yes

Hook

The connection-state hook at which the firewall engine evaluates the rule. The hook encodes both the protocol and the connection state, for example a TCP hook or a TLS client_hello hook. For the hooks that the firewall engine supports and how they map to the connection lifecycle, see Rule groups for a firewall using a Next Generation policy in the AWS Network Firewall Developer Guide and the Suricata firewall mode documentation.

Type: String

Required: Yes

Protocol

The protocol of the rule's hook. The protocol is derived from the hook and must match the hook's protocol prefix. AWS Network Firewall rejects a rule whose protocol doesn't match its hook.

Type: String

Valid Values: IP | TCP | UDP | ICMP | HTTP | FTP | TLS | SMB | DNS | DCERPC | SSH | SMTP | MSN | KRB5 | IKEV2 | TFTP | NTP | DHCP | HTTP2 | QUIC | ICMPV4 | ICMPV6 | SCTP | IPV4 | IPV6 | DOH2 | FTP_DATA | NFS | RDP | RFB | MQTT | PGSQL | SNMP | TELNET | WEBSOCKET | LDAP | POP3 | MDNS | BITTORRENT_DHT | DNP3

Required: Yes

AcceptPriorHooks

Whether AWS Network Firewall automatically accepts the earlier application-layer hooks that a connection must pass to reach this rule's hook. Because the firewall engine is drop by default, accepting prior hooks lets you author a single rule for the hook you care about, instead of also authoring a rule for each earlier hook. This setting accepts the earlier application-layer hooks only; it doesn't accept the TCP layer. For more information, see Rule groups for a firewall using a Next Generation policy in the AWS Network Firewall Developer Guide.

Type: Boolean

Required: No

AlertEnabled

Specifies whether the rule also generates an alert log for the traffic that it matches. Turning on alerting adds a secondary alert action to the rule, so that AWS Network Firewall logs the match in addition to taking the rule's primary action.

Type: Boolean

Required: No

BypassIPSEnabled

Specifies whether an accepted connection bypasses the IPS engine. By default, traffic that the firewall engine accepts advances to the IPS engine for threat inspection. When you turn on this setting for an accept rule, the accepted traffic goes straight to its destination without IPS inspection. You can set the bypass only on accept rules, and it uses the same scope as the rule's accept action; only the flow and packet scopes support a bypass. For more information, see Rule groups for a firewall using a Next Generation policy in the AWS Network Firewall Developer Guide.

Type: Boolean

Required: No

DestIPs

The destination IP addresses and address ranges to inspect for, in CIDR notation. A firewall rule always compiles to a forward-direction rule, so you express inbound compared to outbound traffic through the source and destination addresses.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 1024.

Pattern: ^.*$

Required: No

DestPorts

The destination ports to inspect for.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 1024.

Pattern: ^.*$

Required: No

RuleMetadata

Optional metadata for the rule: whether the rule is enabled and a description. Metadata doesn't change how the rule matches or acts on traffic.

Type: RuleMetadata object

Required: No

RuleOptions

Additional options for the rule. These are the Suricata RuleOptions settings, such as the signature ID (sid) and match keywords.

Type: Array of RuleOption objects

Required: No

SourceIPs

The source IP addresses and address ranges to inspect for, in CIDR notation. A firewall rule always compiles to a forward-direction rule, so you express inbound compared to outbound traffic through the source and destination addresses.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 1024.

Pattern: ^.*$

Required: No

SourcePorts

The source ports to inspect for.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 1024.

Pattern: ^.*$

Required: No

FirewallRule

Contents

See Also