View a markdown version of this page

Working with firewall rule groups in Amazon Network Firewall - Amazon Network Firewall
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Working with firewall rule groups in Amazon Network Firewall

A firewall rule group holds the access-control rules that the firewall engine evaluates. Firewall rules are drop by default and are evaluated at connection-state hooks as a connection progresses. You use them to define which traffic is allowed into your network. The firewall engine is built on Suricata's firewall mode. For more information, see the Suricata firewall mode documentation.

Note

Firewall rule groups don't support IP set references—references to IP addresses or CIDR blocks held in another resource, such as an Amazon Virtual Private Cloud managed prefix list, a resource group, an address list, or a container association. To use CIDR ranges in firewall rules, use rule variables instead. IP set references are available for IPS rule groups and for Classic Network Firewall stateful rule groups; for the Classic version, see IP set references in Suricata compatible Amazon Network Firewall rule groups.

Topics