We have a small VPC with three subnets (WAN (public), LAN (private), DMZ (private)). I'm tasked with setting up a central firewall in the WAN subnet, that monitors all traffic both to the outside world as well as the traffic between subents.
My problem is monitoring the traffic between LAN and DMZ. I've associated each subnet with a routing table, directing all outbound traffic to the firewall and this works fine. Unfortunately, AWS prevents me from adding routes for the traffic between the subnets. Adding routing rules 'inside' the VMs would only partially solve the problem, since LAN contains appliances that don't allow this kind of configuration. Also I feel, this might cause more problems in the long run ... I think making WAN, LAN and DMZ each a VPC instead of a subnet might lead to a solution, but that seems to me a horrible misues of VPCs.
What's the canoical AWS solution to this problem?
Edit 1: I'm trying to set up the classic 'three zones plus central firewall' network. The firewall is supposed to monitor and secure the traffic between the subnets and the individual instances and also from the outside. This includes:
- Watch for unusual connecions and report them. (i.e. the wiki has no business to access the hornetq server and any such connection could indicate that the wiki VM has been compromised)
- Rate limit network traffic. (i.e. the database server is allowed to send reporting emails, but if it starts sending hundreds of emails per second, I'd like to get an alert)
- Detect DDOs.
- ... more security stuff ...
I'm not sure all of this can done with AWS native methods and the central firewall concept just feels more natural to me.
Network Security Groups and ACLs allow me to properly separate the subnets and control the connections between the instances. But I don't see the possibility to do advanced stuff (i.e. rate limiting, ...). My idea is to completely cut traffic between LAN/DMZ subnets and use a classic network configuration: Route all traffic over the firewall and let it decide what happens to it. Unfortunately the routing tables of a VPC don't allow me to route all traffic within the VPC (or a subnet thereof) to a central firewall. So the question is, how can I leverage AWS to get the traffic fom my subnets to my firewall, so it can do its thing.