View a markdown version of this page

Firewall default action - Amazon Network Firewall
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Firewall default action

The firewall default action determines how the firewall engine handles traffic that reaches a hook without matching any firewall rule. The firewall engine is drop by default, so if you don't change this setting, traffic that you don't explicitly allow is dropped. The firewall default action applies only to the firewall engine. In a Next Generation policy, the IPS engine is pass by default and has no separate default-action setting.

  • Drop (default) – Network Firewall discontinues inspection of the traffic and blocks it from reaching its destination. Network Firewall records the drop in your logs if logging is configured.

  • Accept – Network Firewall allows traffic that doesn't match a firewall rule to continue. This makes the firewall engine pass by default rather than drop by default.

    Use this setting when you want the firewall to act as an intrusion prevention system (IPS) only, rather than as an access-control firewall. With an accept default action, the firewall engine passes traffic through to the IPS engine, and the IPS engine's rules provide the protection. This is a common configuration for a policy whose purpose is threat detection and prevention rather than access control. If the policy has a TLS inspection configuration attached, an Accept default action allows TLS-inspected traffic at any stage your firewall rules don't cover, so the IPS engine can inspect it. For more information, see How rules are evaluated for TLS-inspected traffic.

    Warning

    Setting the firewall default action to Accept allows all traffic that you don't explicitly block through the firewall engine. Choose this setting only when you intend the firewall engine to allow traffic by default, and understand that it is a deliberate change away from the drop-by-default security posture.

  • Alert – Network Firewall allows traffic that doesn't match a firewall rule to continue, the same as Accept, and also records an alert log entry each time the default action is applied. This is especially useful while you're authoring a ruleset: with an alert default action, your logs show exactly which traffic is reaching the default action instead of matching one of your rules, so you can see what your allow list is still missing before you switch the default action to Drop. As with an Accept default action, if the policy has a TLS inspection configuration attached, an Alert default action allows TLS-inspected traffic at stages your rules don't cover, and logs it. See How rules are evaluated for TLS-inspected traffic.

  • Reject – Network Firewall blocks the traffic and sends a TCP reset packet back to the client so that the client can immediately establish a new session. This reset applies to TCP traffic. For non-TCP protocols there is no connection to reset, so Network Firewall drops the traffic, the same as the Drop action.