AWS Network Firewall Pricing Calculator
Estimate monthly firewall endpoint and traffic processing charges — before stateful inspection spans multiple Availability Zones.
- No signup
- Instant results
- ~2 min
Rates reviewed
Firewall configuration
us-east-1list rates, pricing as of 2026-07-03. Pricing MCP was permission-blocked; values use AWS public us-east-1 list prices. TLS inspection and stateful/stateless rule processing are included in the endpoint charge. Source: AWS public pricing.
AWS recommends one endpoint per AZ for high availability. $0.395/endpoint/hour.
730 hours = full month of continuous operation.
Who This Tool Is For
Network architects and security teams deploying stateful inspection for VPC traffic — especially in multi-AZ, multi-account, or compliance-driven environments.
Why We Built This Tool
Network Firewall bills on two meters: endpoint hours (fixed per AZ) and traffic processed (variable) — the cost profile shifts dramatically with traffic volume.
What Problem It Solves
- Per-AZ endpoint cost surprise. Each endpoint bills at $0.395/hour regardless of traffic — three AZs, full month = $867 in endpoint fees alone.
- Traffic underestimation. East-west VPC traffic often exceeds internet-facing traffic; both are metered.
- WAF vs Firewall confusion. Network Firewall handles L3/L4 stateful inspection; WAF handles L7 HTTP rules — most production setups need both.
See also AWS WAF pricing and cloud security services.
Frequently Asked Questions
How is AWS Network Firewall billed?
Network Firewall charges on two dimensions: a per-endpoint hourly fee ($0.395/endpoint/hour) and a per-GB traffic processing fee ($0.065/GB). The endpoint charge accrues whether or not traffic flows through it — treat it as a fixed cost per AZ.
Do I need one firewall endpoint per Availability Zone?
Yes. For high availability, AWS recommends deploying one firewall endpoint in each AZ where you have workloads. Traffic must stay within the same AZ as the firewall endpoint to avoid cross-AZ data transfer charges.
What traffic counts toward the per-GB charge?
All traffic passing through the firewall endpoint is metered — including inbound from the internet, outbound to the internet, and east-west traffic between VPCs or subnets. Traffic destined for rejected connections is still counted.
Is TLS inspection priced separately?
TLS inspection (decrypt, inspect, re-encrypt) uses stateful firewall rules and does not carry a separate per-GB surcharge beyond the standard traffic processing rate. You need a TLS inspection configuration attached to your firewall policy, but the inspection itself is included in the $0.065/GB rate.
How does Network Firewall compare to AWS WAF for cost?
AWS WAF protects HTTP/S traffic at Layer 7 and bills by requests (~$0.006/10K). Network Firewall provides stateful Layer 3/4 inspection for all protocol traffic and bills by endpoint-hours and GB. Most production architectures combine both — WAF at the ALB or CloudFront edge, Network Firewall at the VPC perimeter.
Are these rates the same in all AWS regions?
This calculator uses us-east-1 list rates as of 2026-07-03. Endpoint and traffic rates vary by region. Check AWS Network Firewall pricing for your target region.