Rule groups are a list of rules that can be added to the firewall. All the traffic in and out of the VPC should route to the firewall subnet first to scan the package and then forward to the next stage. How to set up Network Firewall for the VPC?

For more information about Network Firewall, please check out this article from AWS.

Network firewall can be applied on IGW, NAT, and Direct connect.

This diagram shows that all traffic in and out of the VPC should pass through the firewall check.

Support both stateful and stateless rules for layer 3 to layer 7 protection.

The Network Firewall has the following features: It scans the packages and then passes them to the subsequent stages. You can use delegated endpoints and subnets to send your VPC traffic to the Network Firewall service. To address these issues and provide a better security setup experience on the VPC, AWS introduced the Network Firewall as an Intrusion Prevention Service in late 2020. Security Group works on the ENI, and your compute instances use ENI to send the traffic out. * Note: a common misconception is that the Security Group applies on the compute (EC2, Lambda etc.), which is incorrect.

No deep package scan (e.g., checking the header information of each package, third-party Intrusion Detection Services (IDS) or Intrusion Prevention Services (IPS) products have been required for this).

No domain name filtering functionality.

They don’t provide VPC level security: Security Groups only apply to Network Interfaces (ENI)* whilst NACL’s are stateless and only apply to individual subnets.You only can work with IP addresses and port numbers.(For more information about OSI and its layers, please refer to this article.) There are a couple of issues with this setup: The security group and network ACL only work on the Network and Transport layers (3 and 4).

Aws network firewall