Score:0

AWS Network Firewall - How to log the blocked connections

ng flag
mon

Question

Is there a way to log the connections blocked by the AWS Network Firewall, or filter the logs of blocked connections?

Background

Currently having setup the rules, and would like to know which IP or domains have been blocked.

enter image description here

Looking at Logging network traffic from AWS Network Firewall but not clear if it is possible.

You can record flow logs and alert logs from your Network Firewall stateful engine.
Flow logs are standard network traffic flow logs. Each flow log record captures the network flow for a specific 5-tuple.

Alert logs report traffic that matches your stateful rules that have an action that sends an alert. A stateful rule sends alerts for the rule actions DROP and ALERT.

From the flow logs, it is not clear if it is passed or blocked.

{
    "firewall_name": "network-firewall-sagemaker-studio-anfw",
    "availability_zone": "us-east-1a",
    "event_timestamp": "1628236046",
    "event": {
        "timestamp": "2021-08-06T07:47:26.000068+0000",
        "flow_id": 1108238612337889,
        "event_type": "netflow",
        "src_ip": "51.222.5.114",
        "src_port": 57528,
        "dest_ip": "10.2.2.60",
        "dest_port": 8088,
        "proto": "TCP",
        "netflow": {
            "pkts": 1,
            "bytes": 40,
            "start": "2021-08-06T07:46:24.365793+0000",
            "end": "2021-08-06T07:46:24.365793+0000",
            "age": 0,
            "min_ttl": 239,
            "max_ttl": 239
        },
        "tcp": {
            "tcp_flags": "02",
            "syn": true
        }
    }
}
Score:0
us flag

You must configure your firewall to log the log type of "Alert".

It will then show source, destination and action (i.e. DROP or ALLOW).

Here is some documentation on how to change the log type:
https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-update-logging-configuration.html

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.