For unencrypted traffic (HTTP), only the host header is analyzed. TLS encryption is kept end-to-end, and only the SNI extension is examined.Deep packet inspection is also out of scope. This solution does not serve applications that aren’t proxy capable.Automated solution deployment via AWS CloudFormation.Proxy metrics, available in CloudWatch Metrics.Proxy access logs delivered to CloudWatch Logs.Giving the proxies’ elastic IP addresses allows you to know what IP addresses your web connections will come from. Sometimes the web sites that you’re communicating want to know your IP address so they can accept traffic from you. One Elastic IP address per proxy instance for internet communication.An auto-scaling group with Elastic Load Balancing (ELB) Network Load Balancers that spread over several of your existing subnets (and Availability Zones) and scale based on CPU load.Encryption in transit is preserved and end-to-end encryption is maintained. Transparent encryption handling, due to the extraction of the domain information from the Server Name Indication (SNI) extension in TLS.

For this option, you do need to be a customer of these external services. Optional domain content filtering based on DNS, delivered by external services like OpenDNS, Quad9, CleanBrowsing, Yandex.DNS or others.An outbound proxy that permit connections to whitelisted domains that you define, while presenting customizable error messages when connections are attempted to unapproved domains.The solution provides you with the following benefits: The proxy can be used for all workloads running in the VPC, like Amazon Elastic Compute Cloud (EC2) and AWS Fargate. This solution is based on the open source HTTP proxy Squid. The solution is scalable, highly available, and deploys in a fully automated way. In this post, I’ll show you how to limit outbound web connections from your VPC to the internet, using a web proxy with custom domain whitelists or DNS content filtering services. Often, you want to allow access to certain well-known domains (for example, to communicate with partners, to download software updates, or to communicate with AWS API endpoints). It’s not practical to prevent all outbound web traffic, though. By limiting outbound traffic to certain trusted domains (called “whitelisting”) you help prevent instances from downloading malware, communicating with bot networks, or attacking internet hosts. July 24, 2019: We’ve added a link to a GitHub repository that contains the stack content for this solution.Ĭontrolling outbound communication from your Amazon Virtual Private Cloud (Amazon VPC) to the internet is an important part of your overall preventive security controls. November 16, 2020: We’ve updated the CloudFormation template and the launch stack URL used in this solution.

Public proxy list