> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Ingress Firewall Setup Solution

> This document illustrates a simple architecture for Ingress traffic inspection firewall that leverages AWS Load Balancers and Aviatrix TGW Orchestrator. The solution also allows you to view the client IP address.

## AWS Ingress Firewall Traffic Inspection

This document illustrates a simple architecture for Ingress traffic inspection
firewall that leverages AWS Load Balancers and

<a href={"/docs/enterprise/" + "10.1" + "/guides/security/firenet/transit-firenet-workflow-aws-tgw"}>Aviatrix TGW Orchestrator</a>
. The solution also allows you to view the client IP address.

The deployment is shown in the below diagram.

<img src="https://mintcdn.com/aviatrix-14b37c43/mOZ0lmP7pRPIryx3/images/guides/security/firenet/ingress-firewall-network-design.png?fit=max&auto=format&n=mOZ0lmP7pRPIryx3&q=85&s=4fbf17d6b55c8947dbb6e0c48ffcceca" alt="ingress_firewall" width="1434" height="788" data-path="images/guides/security/firenet/ingress-firewall-network-design.png" />

The key idea is that from the FireNet point of view, the ingress inspection is
simply a VPC-to-VPC traffic inspection. This is accomplished by:

* Placing an Internet-facing AWS ALB/NLB in a spoke VPC in a separate domain (in
  the diagram, this domain is called Ingress domain) from the domains where
  applications reside (Application domain).
* Building a connection policy to connect the Ingress domain with the
  Application domain.
* Connecting the Application domain traffic that requires inspection with the
  Aviatrix Firewall Domain.

In this unified architecture, firewalls can be used for Ingress, Egress,
North-South and VPC-to-VPC filtering. The solution does not need AWS ALB/NLB to
directly attach to firewall instances which then requires firewall instances to
source NAT the incoming traffic from the Internet.

Firewall instances can scale out as applications scale for all traffic types.

<Note>
  This architecture works for both [AWS Network Load
  Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html)
  and [AWS
  ALB](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html).
  NLB is used for illustration purposes. You can create multiple load balancers
  in the Ingress VPC.
</Note>

## Prerequisite Setup for AWS Ingress Firewall Setup Solution

Follow

<a href={"/docs/enterprise/" + "10.1" + "/guides/security/firenet/transit-firenet-workflow-aws-tgw"}>Aviatrix Transit FireNet workflow</a>
to launch FireNet gateways and firewall instances.

Follow the

<a href={"/docs/enterprise/" + "10.1" + "/guides/security/firenet/transit-firenet-workflow-aws-tgw"}>Aviatrix TGW Orchestrator workflow</a>
to:

* Create an Ingress domain (this domain can be named something else and can be
  an existing domain; just make sure it is in a different domain than
  Application domain).
* Build Connection policy between the Ingress domain and the Application domain.
* Build Connection policy between Application domain and Firewall domain so that
  traffic in and out of the domain is inspected.
* Attach the Application domain VPC (Spoke-2 in the diagram) to the TGW.
* Attach the Ingress domain VPC (Spoke-1 in the diagram) to the TGW.

## Create AWS Network Load Balancer for AWS Ingress Firewall Setup Solution

In the AWS console, on Ingress domain VPC (Spoke-1), create an AWS Network Load
Balancer (NLB) and make sure you select the following.

* Under Basic configuration, select **Internet-facing**.
* On the Target groups page under Basic configuration, select the **IP
  addresses** target type.

## Verifying AWS Ingress Firewall Setup Solution

From the AWS Console, make sure NLB target group is in healthy state.

Run a https request on the NLB DNS name.

The application can also reach the Internet through firewall instances if you
enable Egress on the FireNet.

## Capturing Client IP for AWS Ingress Firewall Setup Solution

### Using AWS Application Load Balancer

AWS ALB automatically preserves client IP addresses. You can find the client IP
address in the HTTP header field "X-Forwarded-For".

To view the client IP address in the access log, follow the instructions in
[How to save client IP in access logs](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html).

## Using AWS Network Load Balancer

When NLB uses IP addresses as the target group, the client IP address of the
packet reaching to the application is one of the NLB node private IP address. If
you want to obtain the original client IP address, you need to enable the
function
[`proxy_protocol_v2.enabled` under Target Group Attributes](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#target-group-attributes)
on the NLB. Review the section "Proxy Protocol" in the above AWS document or
follow the steps below to enable this function on NLB using the AWS console.

1. Open the Amazon EC2 console at
   [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/).
2. On the navigation pane, under Load Balancing, select **Target Groups**.
3. Select the target group.
4. Click the Attributes tab.
5. Click **Edit**.
6. Enable the **Proxy protocol v2** toggle and click **Save**.

Also, you need to configure/support the Proxy Protocol feature on your web
server to retrieve the client original IP address. Follow the steps below which
reflect the AWS document
[How do I capture client IP addresses in the web server logs behind an ELB?](https://repost.aws/knowledge-center/elb-capture-client-ip-addresses).

In Apache/2.4.41 (Ubuntu) (for example), find and open the Apache configuration
file.

`/etc/apache2/apache2.conf`

Edit/add remoteip module configuration into Apache configuration file as below:

```
LoadModule remoteip_module /usr/lib/apache2/modules/mod_remoteip.so
```

[https://httpd.apache.org/docs/2.4/mod/mod\_remoteip.html](https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html)

[https://httpd.apache.org/docs/2.4/mod/mod\_remoteip.html#remoteipproxyprotocol](https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html#remoteipproxyprotocol)

Confirm that the mod\_remoteip module loads by issuing the command as below:

```
$sudo apachectl -t -D DUMP_MODULES | grep -i remoteip
```

Review the output and verify that it contains a line similar to:

```
remoteip_module (shared)
```

<Note>
  If you are not able to view the prompt message, make sure that your Apache
  version supports that module or attempt to load that module into the Apache
  configuration.
</Note>

Configure the following line in your Apache configuration file (use
`/etc/apache2/sites-available/000-default.conf` as an example) to enable Proxy
Protocol support.

```
RemoteIPProxyProtocol On
```

To view client IP address in the access log, edit/add commands into the
LogFormat section as below:

```
LogFormat "%h %p %a %{remote}p %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
```

Save the changes.

Reload the Apache service by issuing the command:

```
#systemctl reload apache2
```

Open the Apache access logs on your Apache server.

Verify that client IP addresses are now recorded under the X-Forwarded-For
header.

<Note>
  Commands and file location varies by configuration. For other OSs and web
  services, see this document: [How do I capture client IP addresses in my ELB
  access
  logs?](https://repost.aws/knowledge-center/elb-capture-client-ip-addresses)
</Note>