Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Network Firewall – New Managed Firewall Service in VPC

aws.amazon.com

Post reply on HN
Print view View original

11–20 of 29 posts

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#11

Post by therockspush »

russellendicott wrote: post #10
jcims wrote: post #5

I wonder if they had to build the new Gateway Load Balancer in their implementation of this, so they decided to turn it into a product as well.

It was a key dependency for this and they also broke it out into a separate product.

This was also something AWS was a couple years behind Azure on.

Azure internal load balancers have some hang ups, but load balancing egress or east-west traffic across security appliances in AWS has always been diabolical in comparison.

I've never used the Geneve protocol, so I can't really tell if this is going to affect which vendors can use the GWLB.

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#13

Post by jcims »

russellendicott wrote: post #10
jcims wrote: post #5

I wonder if they had to build the new Gateway Load Balancer in their implementation of this, so they decided to turn it into a product as well.

It was a key dependency for this and they also broke it out into a separate product.

Makes total sense. I haven't tried it yet but it would have really made life easier for me a couple of years ago. :)

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#14

Post by Scorpiion »

This reminds me of Google clouds built in network firewall[1], which is just called "Google Cloud Firewalls". One difference is that Googles firewall capabilities are built in and part of the platform, no extra service or fees. Just thought it could be an interesting reference for people not so used to GCP.

[1] https://cloud.google.com/firewalls

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#15

Post by qz2 »

CorpOverreach wrote: post #6
coredog64 wrote: post #3

Almost $.40/hour, you need one per AZ, and it’s $.06/GB for network traffic. I’m happy to see the capability (mainly outbound URL filtering), but this looks like it’s going to be a hard sell to my managers. You’re probably looking at a grand per month per account. On the plus side, they don’t double charge for NAT gateway traffic.

For large enough enterprises, $1k a month is a rounding error. Also, depending on how you're provisioning accounts and laying out your networking, you may not want to be sticking one of these in every VPC. There's no one-size-fits-all, but in many cases a transit VPC that handles the egress centrally would make more sense.

It’s really not a rounding error. What happens is we have hundreds of these little rounding errors and some poor dude exists solely to work out where all the money is leaking out of the budget.

Then you find it’s some weird inter VPC peering transit cost through a firewall because something was designed by an external consultancy who didn’t do a cost analysis or didn’t understand which one of the myriad of complex charging rules were invoked. The end game being you’re architecturally tied into paying $1000 a month 100 times over.

Corporate clouds are complicated and with complexity comes extreme expense. Even small ones can escalate quickly.

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#16

Post by sneak »

CorpOverreach wrote: post #6
coredog64 wrote: post #3

Almost $.40/hour, you need one per AZ, and it’s $.06/GB for network traffic. I’m happy to see the capability (mainly outbound URL filtering), but this looks like it’s going to be a hard sell to my managers. You’re probably looking at a grand per month per account. On the plus side, they don’t double charge for NAT gateway traffic.

For large enough enterprises, $1k a month is a rounding error. Also, depending on how you're provisioning accounts and laying out your networking, you may not want to be sticking one of these in every VPC. There's no one-size-fits-all, but in many cases a transit VPC that handles the egress centrally would make more sense.

For large enough enterprises, $1M a month is similarly irrelevant.

Should security pricing only be accessible to businesses over a certain size?

A monthly price floor on services like this is trash. It’s pay-what-you-use, so it should scale evenly down to $0, just like lambda or network transfer usage costs.

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#17

Post by new23d »

Scorpiion wrote: post #14

This reminds me of Google clouds built in network firewall[1], which is just called "Google Cloud Firewalls". One difference is that Googles firewall capabilities are built in and part of the platform, no extra service or fees. Just thought it could be an interesting reference for people not so used to GCP. [1] https://cloud.google.com/firewalls

GCP's built-in firewalling capabilities are quite basic and on par with AWS' Security Groups and NACLs. This new offering is Suricata backed which offers much more sophisticated packet inspection, and is probably built off their recently launched Gateway Load Balancer tech [1].

A key difference is that third-party appliances, and now with Suricata, hostname based (rather than IP addresses) filtering can be applied at the VPC level. This isn't possible in GCP's native offerings.

Disclaimer: I should add that I work for a third-party firewall appliance company myself so have been looking at these developments with a lot of interest.

Although a deep-dive analysis is pending on my side, on the face of it this would seem a security-lite offering as another hacker on this thread has put it. If one were to consider what protocols are supported for hostname based filtering, what depth of checks are run, how ECH/ESNI is handled, and at what level of granularity policies can be attached to individual applications, the offering is a bit underwhelming to say the least. Compare that to our product [2] (on AWS and GCP), and ours is more straightforward to deploy, incorporates the best protocol level decisions already, and has a closer association with individual applications. (You basically stick in the protocol and hostname (even for SSH) in the description field of each Security Group or Firewall Rule.)

[1] https://aws.amazon.com/blogs/aws/introducing-aws-gateway-loa... [2] https://chasersystems.com/

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#19

Post by new23d »

nhoughto wrote: post #18

Hmm transparent proxy, can do 5 tuple and domain filtering, can’t do URL filtering bc doesn’t terminate tls I assume? They Should update the product page and take out “URL filtering” before it confuses other people..

Thank you for raising this! I work for a firewall vendor myself and its drives us mad when competition uses the word URL when they can only look at SNI in a TLS handshake. By competition I mean most others are doing it too.

I guess one of the reasons they choose to say URL over FQDN or hostname is that the latter two are less likely what typical developers might venture out looking for - but I could be wrong. At least the requirements when they emerge would want URLs to be whitelisted and that is what the intercepting proxy world had been delivering.

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#20

Post by nhoughto »

new23d wrote: post #19
nhoughto wrote: post #18

Hmm transparent proxy, can do 5 tuple and domain filtering, can’t do URL filtering bc doesn’t terminate tls I assume? They Should update the product page and take out “URL filtering” before it confuses other people..

Thank you for raising this! I work for a firewall vendor myself and its drives us mad when competition uses the word URL when they can only look at SNI in a TLS handshake. By competition I mean most others are doing it too. I guess one of the reasons they choose to say URL over FQDN or hostname is that the latter two are less likely what typical developers might venture out looking for - but I could be wrong. At leas…

Ergonomics of SNI / domain rules suck, you think it’s ok until you have to choose whether or not to whitelist all of SQS or something and you end up having giant holes in your firewall because you can’t be specific enough and few services cater to those behind proxies..
Post reply on HN