AWS network-firewall documentation change
Summary
Added documentation about application layer drop established action and example rules for allowing TCP flow control packets
Security assessment
Documents security-related firewall behavior and provides explicit pass rules to prevent unintended connection drops. While security-adjacent, there's no evidence this addresses an active exploit or vulnerability.
Diff
diff --git a/network-firewall/latest/developerguide/suricata-rule-evaluation-order.md b/network-firewall/latest/developerguide/suricata-rule-evaluation-order.md index 599a7233f..100481c11 100644 --- a//network-firewall/latest/developerguide/suricata-rule-evaluation-order.md +++ b//network-firewall/latest/developerguide/suricata-rule-evaluation-order.md @@ -96,0 +97,35 @@ For other protocols, such as UDP, Network Firewall considers the connection esta +###### About the application layer drop established action + +When you select the application layer drop established option, the firewall drops connections that have banner packets. After a connection is established, if the firewall sees a packet that no explicit pass rule allows, the firewall drops that packet and all subsequent packets in the connection. This behavior affects TCP flow control packets that occur after the TCP handshake but before a pass rule applies. + +Examples of TCP flow control packets that can result in such drops include: + + * TCP window updates from either client or server, if seen immediately after the TCP handshake. + + * TCP keep-alives from either client or server, if seen immediately after the TCP handshake. + + * TCP resets from either client or server, if seen immediately after the TCP handshake. + + + + +To allow these packets in your environment you can add custom pass rules in a stateful rule group, for example: + +To allow TCP window packets: + + + pass tcp any any -> any any (msg:"Allow all TCP Window Updates from server to client"; tcp.flags:A; dsize:0; window:!0; flow:established, to_client; sid:1000001;) + pass tcp any any -> any any (msg:"Allow all TCP Window Updates from client to server"; tcp.flags:A; dsize:0; window:!0; flow:established, to_server; sid:1000002;) + +To allow TCP keep-alives (will pass all ACKs): + + + pass tcp any any -> any any (msg:"Allow TCP keep alives - all acks - from server to client"; tcp.flags:A; dsize:0; flow:established, to_client; sid:1000003;) + pass tcp any any -> any any (msg:"Allow TCP keep alives - all acks - from client to server"; tcp.flags:A; dsize:0; flow:established, to_server; sid:1000004;) + +To allow TCP resets: + + + pass tcp any any -> any any (msg:"Allow TCP resets from server to client"; tcp.flags:+R; dsize:0; flow:established, to_client; sid:1000005;) + pass tcp any any -> any any (msg:"Allow TCP resets from client to server"; tcp.flags:+R; dsize:0; flow:established, to_server; sid:1000006;) +