Question

A company runs a public-facing web application in a VPC. Internet traffic enters through an Internet Gateway to an Application Load Balancer in public subnets, and the ALB forwards to application instances in private subnets. Security requires that ALL inbound traffic from the Internet be inspected by AWS Network Firewall before reaching the ALB. The team deploys a Network Firewall with firewall endpoints in dedicated firewall subnets. Which route table configuration correctly forces inbound Internet traffic through the firewall endpoint before reaching the public (ALB) subnets?

Accepted Answer

On the Internet Gateway ingress route table, add a route for the public subnet CIDRs pointing to the firewall VPC endpoint; on the public subnet route table, keep the default route (0.0.0.0/0) pointing to the Internet Gateway.

Answer

On the public subnet route table, add a 0.0.0.0/0 route pointing to the firewall VPC endpoint; leave the Internet Gateway with no edge association.

Answer

On the firewall subnet route table, add a route for the public subnet CIDRs pointing to the Internet Gateway; leave the public subnet route table default.

Answer

Attach a security group to the Internet Gateway that redirects all inbound traffic to the firewall endpoint before it reaches the ALB subnets.