AWS Network Firewall and Route 53 Resolver DNS Firewall

Purpose of This Lesson

This lesson explains how AWS Network Firewall protects VPC resources by inspecting routed traffic and how Route 53 Resolver DNS Firewall regulates outbound DNS queries. The key assessment focus is recognizing the correct architecture, route-table behavior, availability design, and centralized-management option for multi-VPC or multi-account environments.

Key Concepts

• AWS Network Firewall is a managed VPC network-protection service.
• It includes stateful and stateless firewall capabilities, an intrusion prevention system (IPS), and web filtering.
• A firewall deployment uses a firewall endpoint, which is a type of VPC endpoint, placed in a dedicated firewall subnet.
• Resources that need protection remain in protected subnets.
• Traffic from protected subnets is routed through the firewall endpoint before reaching external destinations.
• Correct ingress routing is required for bidirectional inspection: inbound traffic must also pass through the firewall endpoint before reaching protected resources.
• AWS Firewall Manager can centrally apply and manage network firewall policies across VPCs and AWS accounts, including environments governed by AWS Organizations.
• Route 53 Resolver DNS Firewall filters and regulates outbound DNS traffic from VPCs.
• DNS Firewall controls which domains applications can query and helps prevent DNS exfiltration.

AWS Network Firewall Architecture and Routing

A typical design separates the protected workload from the firewall endpoint:

• Protected subnet: Contains application resources such as instances and other workloads that require inspection.
• Firewall subnet: Contains the Network Firewall endpoint. Resources should not be deployed in this subnet; it is intended for the firewall infrastructure.
• Route tables: Direct traffic between protected resources, the firewall endpoint, and external connectivity such as the internet gateway.

Egress flow

For outbound protection, the route table associated with the protected subnet sends external traffic—traffic destined outside the VPC CIDR block—to the firewall endpoint. The firewall rules engine inspects the traffic, and permitted traffic is then forwarded toward the internet gateway.

A representative flow is:

Protected resource → Firewall endpoint → Internet gateway → External destination

Ingress flow

Inbound protection requires more than routing outbound traffic through the firewall. The route table associated with the internet gateway must include a route for the relevant protected address that sends inbound traffic to the firewall endpoint in the firewall subnet. This ensures that traffic entering through the internet gateway is inspected before it reaches the protected instances.

A representative flow is:

Internet gateway → Firewall endpoint → Protected resource

The important design principle is that inspection must be enforced in both directions when both ingress and egress protection are required.

Availability considerations

For high availability, allocate a firewall subnet and firewall endpoint in each Availability Zone used by the design. The protected subnet route tables can direct traffic to the endpoint in the corresponding Availability Zone, providing redundancy across Availability Zones. Avoid placing application resources in firewall subnets.

The lecture also identifies use of a gateway load balancer with the Network Firewall architecture. The critical operational distinction for assessment purposes is that the firewall endpoint is the inspection target referenced by the VPC routing design.

Route 53 Resolver DNS Firewall

Route 53 Resolver DNS Firewall operates at the DNS-query layer rather than inspecting arbitrary network traffic. Applications in a VPC use Route 53 Resolver for DNS name resolution, and DNS Firewall filters outbound DNS requests so that domain access can be monitored and controlled.

Its primary uses in this lesson are:

• Regulating which domains applications can query.
• Monitoring domain-query activity.
• Helping prevent data exfiltration through DNS requests.
• Centrally configuring DNS firewall controls across VPCs and accounts with AWS Firewall Manager.

DNS Firewall does not replace Network Firewall. Network Firewall provides broader network traffic protection, while DNS Firewall focuses specifically on outbound DNS name-resolution requests.

Exam- or Assessment-Relevant Takeaways

• If the requirement is to protect VPC workloads with stateful/stateless inspection, IPS, or web filtering, consider AWS Network Firewall.
• If the requirement is to control outbound domain queries or reduce the risk of DNS exfiltration, consider Route 53 Resolver DNS Firewall.
• A firewall endpoint belongs in a dedicated firewall subnet, not in the same subnet as the protected application resources.
• Outbound protection requires the protected subnet route table to send external traffic to the firewall endpoint.
• Bidirectional protection additionally requires ingress routing from the internet gateway toward the firewall endpoint before traffic reaches protected resources.
• High availability calls for firewall subnets and endpoints in multiple Availability Zones.
• For centralized control across multiple VPCs and accounts, use AWS Firewall Manager, potentially integrated with AWS Organizations.
• Do not confuse DNS filtering with full network inspection: DNS Firewall controls DNS queries, whereas Network Firewall protects routed network traffic.

Tool / Feature Decision Guide

Requirement	Appropriate capability	Decisive reason
Inspect and filter general VPC network traffic	AWS Network Firewall	Provides stateful/stateless firewall functions, IPS, and web filtering
Protect workloads in a VPC through a dedicated inspection point	AWS Network Firewall endpoint	Routes protected-subnet traffic through the firewall endpoint
Control which domain names applications can resolve	Route 53 Resolver DNS Firewall	Filters outbound DNS traffic through Route 53 Resolver
Reduce DNS-based data exfiltration risk	Route 53 Resolver DNS Firewall	Helps regulate and control DNS queries
Apply firewall policies across multiple VPCs and accounts	AWS Firewall Manager	Provides centralized configuration and management
Provide resilience across Availability Zones	Multi-AZ firewall subnet and endpoint design	Avoids dependence on a single Availability Zone

Common Traps / Misconceptions

• Only configuring egress routing: Sending outbound traffic through the firewall does not automatically establish inbound inspection. Ingress routes must also direct traffic through the firewall endpoint.
• Deploying application resources in the firewall subnet: The firewall subnet should be dedicated to the firewall endpoint rather than hosting protected workloads.
• Treating DNS Firewall as a complete network firewall: DNS Firewall regulates DNS requests; it is not a substitute for Network Firewall’s broader traffic inspection capabilities.
• Assuming one Availability Zone is sufficient for a highly available design: A multi-AZ design requires firewall infrastructure in each relevant Availability Zone.
• Confusing centralized management with the firewall itself: Firewall Manager manages policies and deployments across environments; it is not the traffic-inspection engine.
• Ignoring the VPC route tables: Merely creating a firewall endpoint does not force traffic through it. The relevant protected-subnet and ingress route tables must be configured accordingly.

Real-World Engineer / Analyst Notes

• Start with the traffic direction: determine whether the requirement concerns outbound traffic, inbound traffic, or both.
• Verify route-table associations, not just route entries. A correct route in the wrong route table will not provide the intended inspection path.
• Keep firewall infrastructure and protected application resources logically separated through dedicated subnets.
• When reviewing a multi-account architecture, distinguish local firewall placement from centralized policy administration. AWS Firewall Manager addresses the latter.
• For DNS security investigations, examine which domains workloads are querying and whether DNS behavior suggests attempted exfiltration.
• Use Network Firewall and DNS Firewall as complementary controls: one addresses network traffic inspection, and the other addresses outbound DNS resolution behavior.

Quick Reference Summary

• Network Firewall: Managed VPC network protection with stateful/stateless firewall capabilities, IPS, and web filtering.
• Firewall endpoint: VPC endpoint placed in a dedicated firewall subnet.
• Protected subnet: Contains workloads whose traffic is inspected.
• Egress routing: Protected subnet sends external traffic to the firewall endpoint.
• Ingress routing: Internet gateway route table sends inbound traffic for protected resources to the firewall endpoint.
• Availability: Use firewall subnets and endpoints across Availability Zones for high availability.
• Firewall Manager: Centralizes firewall policy and deployment management across VPCs and accounts.
• DNS Firewall: Filters outbound DNS requests through Route 53 Resolver and helps prevent DNS exfiltration.

Flashcards

Q: A workload in a protected subnet must send internet-bound traffic through an inspection point. Which route-table change is required?
A: The protected subnet route table must send traffic destined outside the VPC CIDR block to the Network Firewall endpoint.

Q: What additional routing is needed when both inbound and outbound traffic must be inspected?
A: The route table associated with the internet gateway must route inbound traffic destined for protected resources to the firewall endpoint before it reaches those resources.

Q: Where should the AWS Network Firewall endpoint be deployed?
A: It should be deployed in a dedicated firewall subnet. Application resources should not be placed in that subnet.

Q: Why create firewall subnets and endpoints in multiple Availability Zones?
A: The multi-AZ design provides high availability and avoids relying on a firewall endpoint in only one Availability Zone.

Q: An organization wants to block applications from querying unapproved domains. Which service is the best fit?
A: Route 53 Resolver DNS Firewall, because it filters and regulates outbound DNS queries.

Q: How does Route 53 Resolver DNS Firewall help with DNS exfiltration?
A: It lets the organization monitor and control the domains applications can query, helping restrict DNS-based attempts to exfiltrate data.

Q: When should AWS Network Firewall be selected instead of DNS Firewall?
A: Select Network Firewall when the requirement involves broader VPC network-traffic protection, including stateful/stateless inspection, IPS, or web filtering rather than only DNS-query control.

Q: What is the role of AWS Firewall Manager in this architecture?
A: Firewall Manager centrally configures and manages firewall policies and deployments across VPCs and AWS accounts, including environments organized through AWS Organizations.

Q: What is the difference between a protected subnet and a firewall subnet?
A: A protected subnet contains the application resources being defended. A firewall subnet contains the firewall endpoint used to inspect routed traffic.

Q: Why is creating a Network Firewall endpoint alone insufficient to protect traffic?
A: Traffic must be routed through the endpoint. Without the appropriate protected-subnet and, when needed, internet-gateway route-table entries, traffic can bypass inspection.

Q: What traffic path represents protected outbound access?
A: Protected resource → Firewall endpoint → Internet gateway → External destination.

Q: What traffic path represents protected inbound access?
A: Internet gateway → Firewall endpoint → Protected resource.

Practice Questions

Question 1

A company routes outbound traffic from its application subnet to an AWS Network Firewall endpoint. However, inbound internet traffic reaches the application instances without being inspected. What is the most likely missing configuration?

A. A DNS Firewall rule for the application domain
B. An internet gateway route directing traffic for the protected resources to the firewall endpoint
C. A second Route 53 Resolver endpoint in the application subnet
D. A gateway load balancer deployed in the protected subnet

Correct answer: B. Egress routing alone does not provide bidirectional protection. The route table associated with the internet gateway must direct inbound traffic for the protected resources through the firewall endpoint.

Question 2

A security team wants to prevent workloads from resolving domains associated with unauthorized services and reduce the risk of DNS-based data exfiltration. Which service should it use?

A. AWS Network Firewall only
B. AWS Firewall Manager only
C. Route 53 Resolver DNS Firewall
D. An internet gateway route table

Correct answer: C. Route 53 Resolver DNS Firewall is designed to filter and regulate outbound DNS traffic and control the domains applications can query.

Question 3

An enterprise has several VPCs across multiple AWS accounts and wants consistent Network Firewall policy management. Which capability best addresses the centralized-management requirement?

A. Deploy all workloads in one firewall subnet
B. Use AWS Firewall Manager with AWS Organizations
C. Configure only the protected subnet route tables
D. Replace Route 53 Resolver with an internet gateway

Correct answer: B. AWS Firewall Manager can centrally configure and manage firewall deployments and policies across VPCs and accounts, including those managed through AWS Organizations.

Question 4

An architect is designing a highly available Network Firewall deployment for workloads spread across two Availability Zones. Which design is most appropriate?

A. One firewall subnet in one Availability Zone and shared application resources in it
B. A firewall endpoint in each relevant Availability Zone, with application resources kept in protected subnets
C. One DNS Firewall rule per Availability Zone with no Network Firewall endpoints
D. A single internet gateway route with no protected-subnet routes

Correct answer: B. High availability requires firewall infrastructure across the relevant Availability Zones, while protected workloads remain in protected subnets and route traffic through the appropriate endpoints.

WordPress Metadata

Suggested Slug:
aws-network-firewall-route-53-dns-firewall

Meta Description:
Study AWS Network Firewall and Route 53 Resolver DNS Firewall, including subnet placement, bidirectional routing, DNS exfiltration prevention, and centralized management with Firewall Manager.

Tags:
AWS Network Firewall, Route 53 Resolver DNS Firewall, AWS Firewall Manager, VPC networking, VPC endpoints, network security, DNS security, AWS Organizations, stateful firewall, stateless firewall