View a markdown version of this page

Generating firewall rules from domain names - Amazon Network Firewall
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Generating firewall rules from domain names

A firewall rule group can generate rules from a list of domain names, so that you can allow traffic to a set of domains without authoring the matching rules yourself. Domain name rule generation in the firewall engine supports allow lists only: it generates accept rules for the domains you list. To block a domain, you don't add it to an allow list, which is consistent with the firewall engine's drop-by-default behavior.

You can match a domain by one or more of the following target types, individually or combined:

  • TLS SNI – Match the server name indication (SNI) in the TLS handshake.

  • HTTP host – Match the Host header in an HTTP request.

  • Route 53 resolved domain – Match traffic to the IP addresses that Amazon Route 53 resolved for the domain.

By default, the generated rules match traffic from HOME_NET—the CIDR range of the VPC where the firewall is deployed. To match a different source range, in the console choose Custom under Source IPs and enter the ranges, or through the API define a HOME_NET IP set in the rule group's RuleVariables.

You can use a wildcard to match a domain and all of its subdomains by starting the domain with a dot, for example .example.com.

  • Explicit names. For example, abc.example.com matches only the domain abc.example.com.

  • Names that use a domain wildcard, which you indicate with an initial '.'. For example,.example.com matches example.com and matches all subdomains of example.com, such as abc.example.com and www.example.com.

The rules that Network Firewall generates from your domain names count toward the firewall rule limit for the policy. If you generate rules for a large number of domains, keep this limit in mind. For the limit, see Amazon Network Firewall quotas.

Note

Domain name rule generation is available for firewall rule groups. It isn't available for IPS rule groups.