AWS Network Firewall and Route 53 DNS Firewall Deep Dive

Jesse Lepich of Amazon Web Services took a deep dive into AWS Network Firewall and Route 53 DNS Firewall, explaining how the two services secure both the routed and recursive DNS egress paths in AWS environments. The session covered Network Firewall’s managed architecture, MadPot-powered active threat defense, automated domain list learning, and a console walkthrough of logging, monitoring, and managed rules. After a brief introduction from Brandon Carroll at Security Field Day 16, Lepich pointed to shrinking attack timelines driving demand for preventative guardrails.

Customers steer traffic to a Network Firewall endpoint in each availability zone, rated for 100 Gbps, where Gateway Load Balancer spreads flows across an AWS-managed EC2 fleet that shares state so instances can be replaced without dropping traffic. Egress security is the top use case, and Lepich stressed that attackers use the recursive DNS path independently of the routed path, even holding conversations with LLM chatbots through DNS records. Tighter integration lets DNS Firewall check with Network Firewall before answering a query, enabling domain filtering on any protocol, a checkbox to block direct-to-IP connections, and detection of SNI spoofing. Blocking DNS over HTTPS and public resolvers relies on documented rules from the best practice guide, and a delegate pressed for a managed easy button that Lepich agreed would help.

New capabilities aim to make protection easier to adopt. Active threat defense draws on MadPot, a global honeypot network with thousands of decoys across AWS regions that captures what attackers reach for after compromise. Traffic analysis mode is a free learning feature that lists observed domains with access counts and unique sources, then converts them into an allow list rule group with a click, though drilling into specific sources still requires the logs. Network Firewall also supports rules based on EKS and ECS workload names, URL categories, partner rules through AWS Marketplace, and an explicit proxy in preview, while the monitoring dashboard flags AWS services that should use VPC endpoints instead of crossing the firewall. Lepich’s recurring advice was to start with a loose allow list rather than deny lists and tighten it over time, bringing least privilege from identity to network flows.