AWS Network Firewall now defaults to "Application drop established (server-directed only)" for all new firewall policies, replacing the prior bidirectional drop default. The previous setting could inadvertently block legitimate server-to-client packets such as keep-alives and window updates, causing hard-to-diagnose connection issues.
The new default minimizes these interruptions by restricting the drop action to server-directed flows only, improving network reliability out-of-the-box. Existing users who require the earlier behavior for specific use cases like post-quantum cryptography can adjust rules per AWS’s guidance. This update is available globally in supported regions.
Source & further reading
AWS Network Firewall updates default drop action for improved connection reliability ↗Source published 2026-06-22. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.