Know your stateful inspection cost before you deploy
AWS Network Firewall Pricing Calculator
Estimate monthly firewall endpoint and traffic processing charges — before stateful inspection spans multiple Availability Zones.
- No signup
- Instant results
- ~2 min
Rates reviewed
Firewall configuration
us-east-1list rates, pricing as of 2026-10-17. AWS public us-east-1 list prices. Stateful/stateless rule processing is included in the endpoint and per-GB charges. TLS inspection adds an Advanced Inspection hourly charge per primary endpoint; Advanced Threat Protection adds a per-GB charge. The NAT gateway waiver is not subtracted. Source: AWS public pricing.
AWS recommends one endpoint per AZ for high availability. $0.395/endpoint/hour.
730 hours = full month of continuous operation.
Extra VPCs associated with the same firewall in the same AZ. $0.158/endpoint/hour, no extra per-GB charge.
Traffic volume
All inbound, outbound, and east-west traffic inspected by the firewall. $0.065/GB.
Estimated Network Firewall Cost
Monthly firewall estimate
Total Monthly Cost
live resultPer-GB unit economics and cost vs WAF comparison unlock after email
Unlock Network Firewall Analysis
See per-GB unit economics and how firewall cost scales with your traffic volume.
Firewall breakdown unlocked
Cost metrics and architecture guidance are now visible.
Want this applied to your real account?
FactualMinds designs defense-in-depth architectures combining Network Firewall, WAF, Shield, and GuardDuty — with cost governance built in.
Explore Cloud Security Services →Who This Tool Is For
Network architects and security teams deploying stateful inspection for VPC traffic — especially in multi-AZ, multi-account, or compliance-driven environments.
Why We Built This Tool
Network Firewall bills on two meters: endpoint hours (fixed per AZ) and traffic processed (variable) — the cost profile shifts dramatically with traffic volume.
What Problem It Solves
- Per-AZ endpoint cost surprise. Each endpoint bills at $0.395/hour regardless of traffic — three AZs, full month = $867 in endpoint fees alone.
- Traffic underestimation. East-west VPC traffic often exceeds internet-facing traffic; both are metered.
- WAF vs Firewall confusion. Network Firewall handles L3/L4 stateful inspection; WAF handles L7 HTTP rules — most production setups need both.
See also AWS WAF pricing and cloud security services.
Frequently Asked Questions
How is AWS Network Firewall billed?
Network Firewall charges on two dimensions: a per-endpoint hourly fee ($0.395/endpoint/hour) and a per-GB traffic processing fee ($0.065/GB). The endpoint charge accrues whether or not traffic flows through it — treat it as a fixed cost per AZ.
Do I need one firewall endpoint per Availability Zone?
Yes. For high availability, AWS recommends deploying one firewall endpoint in each AZ where you have workloads. Traffic must stay within the same AZ as the firewall endpoint to avoid cross-AZ data transfer charges.
What traffic counts toward the per-GB charge?
All traffic passing through the firewall endpoint is metered — including inbound from the internet, outbound to the internet, and east-west traffic between VPCs or subnets. Traffic destined for rejected connections is still counted.
Is TLS inspection priced separately?
Yes, by the hour. Enabling TLS inspection adds an Advanced Inspection charge of $0.380 per endpoint per hour in us-east-1 on top of the standard $0.395 endpoint rate. There is no extra per-GB charge — inspected traffic bills at the standard $0.065/GB.
What do secondary endpoints and Advanced Threat Protection cost?
Associating a firewall with more VPCs creates secondary endpoints at $0.158 per endpoint per hour (same AZ), with no additional data processing charge. Advanced Threat Protection — active threat defense managed rule groups — adds $0.005 per GB processed.
Does Network Firewall waive NAT gateway charges?
Yes. When a NAT gateway sits in the same Region and the same networking path as your firewall, standard NAT gateway hourly and data processing charges are waived one-to-one against firewall endpoint hours (primary and secondary) and firewall GB processed. This calculator does not subtract that saving.
How does Network Firewall compare to AWS WAF for cost?
AWS WAF protects HTTP/S traffic at Layer 7 and bills by requests (~$0.006/10K). Network Firewall provides stateful Layer 3/4 inspection for all protocol traffic and bills by endpoint-hours and GB. Most production architectures combine both — WAF at the ALB or CloudFront edge, Network Firewall at the VPC perimeter.
Are these rates the same in all AWS regions?
This calculator uses us-east-1 list rates as of 2026-10-17. Endpoint and traffic rates vary by region. Check AWS Network Firewall pricing for your target region.
