Guest netfilter protection by virtual machine function

A method comprising:

• booting, by a hypervisor to execute on one or more processors on a computer system, a guest operating system on a virtual machine;
• sending, by the guest operating system, a list of networking filter rules to a virtual machine function to execute on the virtual machine;
• storing, by the virtual machine function, the list of networking filter rules in a virtual machine function memory;
• preventing, by the hypervisor, the guest operating system from directly accessing a virtual network interface controller on the virtual machine;
• and
• allowing, by the hypervisor, the virtual machine function to access the virtual network interface controller.

A non-transitory machine readable medium storing instructions, which when executed by a processor, cause the processor to:

• boot, by a hypervisor to execute on one or more processors on a computer system, a guest operating system on a virtual machine;
• send, by the guest operating system, a list of networking filter rules to a virtual machine function to execute on the virtual machine;
• store, by the virtual machine function, the list of networking filter rules in a virtual machine function memory;
• prevent, by the hypervisor, the guest operating system from directly accessing a virtual network interface controller on the virtual machine;
• and
• allow, by the hypervisor, the virtual machine function to access the virtual network interface controller.