[Quick Bites] Firewall

This is part of my enterprise cloud architecture series.

In basics, you don't spin up a firewall. It's a secondary thought. But firewalls are 1 of the most important defences and there is more to what you know about them.

Your idea of firewall probably comes mostly from a Windows Firewall.

What is a firewall?

The firewall is basically looking at the network packets based on a ruleset given to it, that you write or are default rulesets. These inform the firewall whether these packets are allowed to go or are dropped.

Ingress and egress

Most people only think about ingress, the traffic coming to the computer. In an enterprise firewalls are for both ingress and egress. Egress is also important.

Egress matters because you have to filter traffic going out. Attacks can come from both inside the VPC and the internet. Making sure isolation is created both ways, so that you monitor traffic both ways, helps a lot.

Different flavours

Firewalls come in different flavours.

A cloud native firewall is the firewall service that is provided by the cloud provider. It's a good enough solution that allows smaller-scale apps or less sensitive apps to not have to worry about security too much. The cloud native ones are AWS NFW and Azure native firewall.

Then you have the pricier ones like Checkpoint and Palo Alto, where you provision specific VMs that do the firewall for you, with Suricata rules managed by them.

The benefit of paying is management. Native firewalls need you to own the rulesets and make sure you are secure. Paying lets you stay up to date with management from these companies, who are meant to keep you secure faster and better because they are at the forefront.

Suricata rules

A Suricata ruleset is a high performance Network IDS, IPS and Network Security Monitoring engine. These are a common standard to write your firewall rulesets and provide good ways to have alerts for specific things you are looking for. You can use basic ones or customise the way you want.

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP GET Request Containing Rule in URI"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"rule"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;)

Example from the Suricata docs.

AWS WAF

AWS firewall can be supplemented with WAF as well. WAF is an add on and its purpose is L7, like we talked about with ALB and NLB. Similar to that, NFW is meant for L4 and protects the whole VPC, and WAF adds L7 protection against XSS and other web specific attacks.

Pillars

Decision made on what type depends on security / cost appetite. Are you okay with higher cost so you have more security but a more complex architecture.

An Example:

flowchart LR
    internet([Internet])

    subgraph vpc [VPC]
        direction LR
        igw[Internet Gateway]

        subgraph fw [Firewall subnet]
            nfw[AWS Network Firewall endpoint<br/>L4, ingress and egress]
        end

        subgraph pub [Public subnet]
            alb[Application Load Balancer<br/>AWS WAF attached, L7]
            nat[NAT Gateway]
        end

        subgraph priv [Private subnet]
            app[App servers]
        end
    end

    internet -->|ingress| igw --> nfw --> alb --> app
    app -->|egress| nat --> nfw -.-> igw -.-> internet

Next up: Common services (e.g. IAM, ACM, KMS)