View a markdown version of this page

Common hooks for common protocols - Amazon Network Firewall
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Common hooks for common protocols

The following table lists, for the protocols that customers most commonly filter, a common hook to use for a simple allow or deny rule and the keywords that become available at that hook. These are common choices, not the only valid ones—each protocol exposes more hooks than are listed here. For a rule that matches one of the listed keywords, use the hook shown. For a rule that matches no protocol field, you can use any valid hook for the protocol; the hook shown is a reliable default. For the full set of hooks each protocol exposes and the complete keyword reference, see the Firewall design documentation.

Protocol Hook type Common hook Example keywords at that hook
TLS Application tls:client_hello tls.sni, tls.version (the version the client offered; to match the negotiated version, match tls.version on the server-to-client direction, such as in an IPS rule), ja3.hash, aws_domain_category (certificate keywords such as tls.cert_subject are at tls:client_cert and tls:server_cert)
HTTP/1.1 Application http1:request_headers http.host, http.header, http.user_agent, aws_url_category (method and URI are at http1:request_line)
HTTP/2 Application substate http2:stream:request_headers http.host, http.method, http.uri, http.header
DNS Application (UDP) dns:request_complete Query-name buffers such as dns.query (header fields such as dns.opcode are at dns:request_started)
SSH Application ssh:request_banner_done ssh.proto, ssh.software, ssh.hassh
TCP, UDP, SCTP Packet tcp:all, udp:all, sctp:all Header and flow keywords such as tcp.flags, dsize, flow, geoip (no application-layer keywords)
IP, ICMP Packet ip:all, icmp:all ttl, ipopts, fragbits, itype, icode, geoip
Note

HTTP/2 carries each request in a separate stream, so its hooks have an extra level in the token: http2:stream:hook for per-request matching. A http2:global:hook form also exists for whole-connection rules that don't match per-request content. Use the stream form to match request fields such as the host.

The rule-header token for HTTP/1.1 is http1, not http. A rule string that uses http:hook is rejected. In a modeled rule, you select the protocol HTTP, which is the modeled alias for http1; Network Firewall compiles it to the http1 token in the rule string. (HTTP/2 is a separate protocol, http2.)