Distributed firewall in a virtualized computing environment

A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a computing device capable of acting as a firewall controller, cause the processor to perform a method to implement a distributed firewall in a virtualized computing environment that includes a source host and a destination host, the method comprising:

• retrieving a first firewall rule that is applicable at the destination host to an ingress packet destined for a destination virtualized computing instance supported by the destination host, wherein the first firewall rule is applicable at the destination host to drop the ingress packet having a set of packet fields;
• based on the first firewall rule, generating a second firewall rule that is applicable at the source host to an egress packet destined for the destination virtualized computing instance, wherein the second firewall rule is generated in addition to the first firewall rule, and applicable at the source host to drop the egress packet having the set of packet fields;
• and
• instructing the source host to apply the second firewall rule to, in response to the source host detecting the egress packet having the set of packet fields, drop the egress packet such that the egress packet is not sent from the source host to the destination host.

A computing device configured to implement a distributed firewall in a virtualized computing environment that includes a source host and a destination host, comprising:

• a processor;
• and
• a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to:
• retrieve a first firewall rule that is applicable at the destination host to an ingress packet destined for a destination virtualized computing instance supported by the destination host, wherein the first firewall rule is applicable at the destination host to drop the ingress packet having a set of packet fields;
• based on the first firewall rule, generate a second firewall rule that is applicable at the source host to an egress packet destined for the destination virtualized computing instance, wherein the second firewall rule is generated in addition to the first firewall rule, and applicable at the source host to drop the egress packet having the set of packet fields;
• and
• instruct the source host to apply the second firewall rule to, in response to the source host detecting the egress packet having the set of packet fields, drop the egress packet such that the egress packet is not sent from the source host to the destination host.