Skip to main content
emnode / learn
Compliance Medium severity

AWS Security Hub · NetworkFirewall

NetworkFirewall.4: Default stateless action (full packets)

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub NetworkFirewall.4 check?

NetworkFirewall.4 checks a firewall policy's default stateless action for full (un-fragmented) packets. It passes when that catch-all is aws:drop or aws:forward_to_sfe, and fails when it is aws:pass — which lets unmatched packets straight through with no further inspection.

Why does NetworkFirewall.4 matter?

A pass default turns the firewall into a sieve: the only traffic blocked is whatever a stateless rule happened to match, and those rules are deliberately simple 5-tuple matches. Everything else — in practice the overwhelming majority of normal traffic — sails past both engines, so the intrusion-detection rules in your stateful engine never even run on it.

How do I fix NetworkFirewall.4?

  1. Set the policy's stateless default action for full packets to aws:forward_to_sfe so unmatched traffic reaches the stateful engine.
  2. Use aws:drop instead if you want an explicit deny-by-default with no stateful inspection.
  3. Add explicit pass rules for the specific trusted flows you intend to fast-path.

Remediation script · bash

# Attach the AWS Managed Rules common baseline to an empty web ACL, in Count mode.
# update-web-acl REPLACES the entire Rules array, so supply the full desired set and the current LockToken.
aws wafv2 update-web-acl \
  --scope REGIONAL --name public-alb-waf --id a1b2c3d4-0000-1111-2222-3333 \
  --lock-token e4f5g6h7 --default-action Allow={} \
  --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=public-alb-waf \
  --rules '[{"Name":"AWS-CommonRuleSet","Priority":0,"Statement":{"ManagedRuleGroupStatement":{"VendorName":"AWS","Name":"AWSManagedRulesCommonRuleSet"}},"OverrideAction":{"Count":{}},"VisibilityConfig":{"SampledRequestsEnabled":true,"CloudWatchMetricsEnabled":true,"MetricName":"AWS-CommonRuleSet"}}]'

# Associate a baseline web ACL with an unprotected API Gateway stage (the resource ARN is the stage, not the API).
aws wafv2 associate-web-acl \
  --web-acl-arn arn:aws:wafv2:us-east-1:111122223333:regional/webacl/prod-api-baseline/1a2b3c4d \
  --resource-arn arn:aws:apigateway:us-east-1::/restapis/a1b2c3d4e5/stages/prod

# Protect a Network Firewall from accidental deletion.
aws network-firewall update-firewall-delete-protection \
  --firewall-name prod-egress-inspection --delete-protection

Full walkthrough (console steps, edge cases and verification) in the lesson Protect APIs and edge with WAF.

Is NetworkFirewall.4 a false positive?

NetworkFirewall.5 is the sibling control for fragmented packets — fixing the full-packet default here does not clear a fragment-default finding, and vice versa. Both defaults must be non-pass.

Full lesson Protect APIs and edge with WAF Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for NetworkFirewall controls ↗ Check your own account for NetworkFirewall.4 →
Part of the learning path Lock down access

More NetworkFirewall controls