Security groups decide which service may reach which inside your VPCs. A firewall adds one central place, with ordered allow and deny rules, for traffic that crosses the hub or leaves for the internet. A firewall lives only in a Network Hub, so create a hub first (see Network Hub).
Choose the traffic
| Traffic through the firewall | What happens |
|---|---|
| Between spokes | Every connection between the hub’s VPCs and VPNs goes through the firewall, across regions too. On a Star hub this also lets edges reach each other, always through the firewall. |
| To the internet | The VPCs of the hub owner’s account reach the internet through the firewall instead of a NAT Gateway, from the firewall’s static public IPs. Other accounts’ VPCs keep their own way out. |
Add a firewall to the hub
- On the hub’s page, under Secured Hub, click Add a firewall to the hub (hub managers only).
- Name and traffic: name it and choose Between spokes, To the internet, or both.
- Tier and size: Basic for small systems (one size, 1–2 instances), or Standard to choose a size and run up to 4 instances that all carry traffic. More than one instance per region gives high availability.
- Policy: New policy from a template (allow web and DNS out, block all outbound, or publish a web server to the internet), or Use an existing policy.
- Click Create firewall.
If a VPC already has a NAT Gateway, the firewall takes over its internet traffic once it is ready. You can keep the NAT Gateway’s static IP so partners that allowlist it keep working; otherwise, send them the firewall’s Public IPs.
Firewall Policy: the rules
Rules live in a policy, kept apart from the firewall, so one policy can serve many firewalls. Open Firewall Policy in the menu:
- Policies: a policy holds rule collection groups, each with collections of rules. Lower priority numbers (100–65000) are checked first. Click Save policy, and new connections follow the new rules at once.
- Network rules allow or deny by source, destination, protocol and port. DNAT rules forward connections that reach the firewall’s public IPs to a private server in a VPC.
- DNAT rules are checked first, then Network rules by priority. A connection that matches no rule is denied, so a policy with no rules denies everything.
- A Parent policy’s rules always come first and can’t be changed from the child: a baseline a central team sets for every hub.
- IP Groups: named lists of ranges, such as office or partner addresses, to use in rules. Edit one and every rule that names it follows.
- Each rule shows how many connections matched it, so you can see which rules are in use.
A firewall is billed per instance-hour by size, including the firewall software, plus the data it processes; the create page shows an estimate. It belongs to the hub owner’s project, which pays for it. Internet egress is billed as usual (see the pricing page).
If you delete the firewall, spokes reach each other again as the hub’s topology allows, and VPCs that went out to the internet through it can’t reach the internet until you create a NAT Gateway or a new firewall. Its public IPs are released; the policy stays.
If something goes wrong
After adding the firewall, a service can’t reach the internet
No rule in the policy allows it. Add a Network rule that allows the service’s range to the destination and port, for example TCP 443 to Internet, or start from the “Allow web (HTTP/HTTPS) and DNS out” template.
A partner says our IP changed
With To the internet, traffic leaves from the firewall’s public IPs. Give the partner every IP listed under Public IPs on the firewall’s page.
Two Edge VPCs still can’t reach each other
Edges reach each other only when the firewall carries Between spokes traffic and a Network rule allows the connection. The security groups on the receiving side must allow it too.