Content tagged with "network-firewall"
Verified centralized Network Firewall Proxy architecture across VPCs. SourceVpc enables per-VPC policy control via PrivateLink endpoints, while SourceIp is NATed and unusable in cross-VPC setups.
Enabled TLS intercept on Network Firewall Proxy using ACM Private CA. Verified PreRequest phase HTTP method blocking, PostResponse Content-Type filtering, and documented PCA configuration gotchas and Preview-specific limitations.
Hands-on verification of AWS Network Firewall Proxy (Public Preview). Tested NAT Gateway integration, PreDNS domain filtering, source-based access control, and DNS spoofing resistance.
HTTP absolute-form requests expose headers to the proxy without TLS decryption. The documentation's 'only filter based on IP' statement applies to HTTPS only.
Cross-VPC access through PrivateLink endpoints NATs the source IP to the endpoint's ENI IP. Use SourceVpc or SourceVpce instead of SourceIp for cross-VPC source identification.