[AWS 网络防火墙]为什么我不能通过不同的请求和响应路由进行通信？

Question

I have a question about network.

I am testing a AWS Network Firewall in AWS with private Subnet and NAT Gateway.

So, My Connection Flow with Internet is:

Request: EC2 in private subnet -> NAT gateway -> FW -> IGW

Response: Server from Internet -> FW -> NAT -> EC2 in private subnet

Request and Response flows are exactly reversed. but, I want to filter only Egress traffic, so I changed Response Route with changing Ingress Route table which applied to IGW. Because AWS Network Firewall is transparent, so I thought that it would be okay.

New Response route: Server from Internet -> NAT -> EC2 in private subnet

What i expected is just only checking Egress traffic, but it didn't work. I mean, they couldn't connect with Internet.

So What i want to know is:

1. Is there any problem to communicate with different route? isn't possible anyway?
2. if possible, what should i do?

Thank you for reading this question.

Answer 1

i got a answer of this question. It is asymmetric flow(request and response flow are different), but route traffic through a middlebox appliance in VPC is not allowed.So the traffic above is not available!!! ( https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html )

Of course, My answer can be wrong. Please feel free to correct this answer. :)