# US 10,873,566 B2 · Distributed firewall in a virtualized computing environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,566 B2 - Document ID: US10873566B2 - Status: Granted - Kind: B2 - Application number: 15/050,478 - Filed: 2016-02-23 - Published: 2017-08-24 - Granted: 2020-12-22 - Earliest claimed: 2016-02-23 - Assignees: Nicira, Inc. - Applicants: Nicira, Inc. - Inventors: Donghai Han - Web page: https://patentgrep.com/patent/US10873566B2 ## CPC - H04L 63/0263: {Rule management} - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Example methods are provided for a firewall controller to implement a distributed firewall in a virtualized computing environment that includes a source host and a destination host. The method may comprise retrieving a first firewall rule that is applicable at the destination host to an ingress packet destined for a destination virtualized computing instance supported by the destination host; and based on the first firewall rule, generating a second firewall rule that is applicable at the source host to an egress packet destined for the destination virtualized computing instance. The method may further comprise instructing the source host to apply the second firewall rule to, in response to determination that the egress packet is blocked by the second firewall rule, drop the egress packet such that the egress packet is not sent from the source host to the destination host. ## Claims ### Claim 1 A method for a computing device to implement a distributed firewall in a virtualized computing environment that includes the computing device, a source host and a destination host, the method comprising: retrieving a first firewall rule that is applicable at the destination host to an ingress packet destined for a destination virtualized computing instance supported by the destination host, wherein the first firewall rule is applicable at the destination host to drop the ingress packet having a set of packet fields; based on the first firewall rule, generating a second firewall rule that is applicable at the source host to an egress packet destined for the destination virtualized computing instance, wherein the second firewall rule is generated in addition to the first firewall rule, and applicable at the source host to drop the egress packet having the set of packet fields; and instructing the source host to apply the second firewall rule to, in response to the source host detecting the egress packet having the set of packet fields, drop the egress packet such that the egress packet is not sent from the source host to the destination host, wherein the retrieving, generating, and instructing are performed by the computing device. ### Claim 2 (depends on 1) The method of claim 1, wherein the destination host implements a firewall engine configurable by the computing device, and prior to the retrieving the first firewall rule, the method further comprises: receiving, from the firewall engine of the destination host, a report message reporting the destination host applying the first firewall rule to drop ingress packets from a source network address; and based on the source network address, selecting the source host to be instructed to apply the second firewall rule. ### Claim 3 (depends on 1) The method of claim 1, wherein, prior to the retrieving the first firewall rule, the method further comprises: selecting the destination virtualized computing instance; and selecting multiple source virtualized computing instances supported by at least one source host to be instructed to apply the second firewall rule. ### Claim 4 (depends on 1) The method of claim 1, wherein the generating the second firewall rule comprises: based on the first firewall rule that specifies a pass action and a set of required packet fields, generating the second firewall rule to specify a drop action to drop the egress packet in response to the source host detecting the egress packet having the set of packet fields that do not satisfy the set of required packet fields specified by the first firewall rule. ### Claim 5 (depends on 1) The method of claim 1, wherein the generating the second firewall rule comprises: generating the second firewall rule to be applicable at a virtual network interface controller (VNIC) via which egress packets from a source virtualized computing instance supported by the source host are sent. ### Claim 6 (depends on 1) The method of claim 1, wherein the generating the second firewall rule comprises: generating the second firewall rule to be applicable at a physical network interface controller (PNIC) via which egress packets from a source virtualized computing instance supported by the source host are sent. ### Claim 7 (depends on 1) The method of claim 1, wherein the source host implements a firewall engine configurable by the computing device and the instructing the source host comprises: sending, to the firewall engine, a control message to configure the firewall engine to apply the second firewall rule to the egress packet at the source host. ### Claim 8 A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a computing device capable of acting as a firewall controller, cause the processor to perform a method to implement a distributed firewall in a virtualized computing environment that includes a source host and a destination host, the method comprising: retrieving a first firewall rule that is applicable at the destination host to an ingress packet destined for a destination virtualized computing instance supported by the destination host, wherein the first firewall rule is applicable at the destination host to drop the ingress packet having a set of packet fields; based on the first firewall rule, generating a second firewall rule that is applicable at the source host to an egress packet destined for the destination virtualized computing instance, wherein the second firewall rule is generated in addition to the first firewall rule, and applicable at the source host to drop the egress packet having the set of packet fields; and instructing the source host to apply the second firewall rule to, in response to the source host detecting the egress packet having the set of packet fields, drop the egress packet such that the egress packet is not sent from the source host to the destination host. ### Claim 9 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the destination host implements a firewall engine configurable by the computing device, and prior to the retrieving the first firewall rule, the method further comprises: receiving, from the firewall engine of the destination host, a report message reporting the destination host applying the first firewall rule to block ingress packets from a source network address; and based on the source network address, selecting the source host to be instructed to apply the second firewall rule. ### Claim 10 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein, prior to the retrieving the first firewall rule, the method further comprises: selecting the destination virtualized computing instance; and selecting multiple source virtualized computing instances supported by at least one source host to be instructed to apply the second firewall rule. ### Claim 11 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the generating the second firewall rule comprises: based on the first firewall rule that specifies a pass action and a set of required packet fields, generating the second firewall rule to specify a drop action to drop the egress packet in response to the source host detecting the egress packet having the set of packet fields that do not satisfy the set of required packet fields specified by the first firewall rule. ### Claim 12 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the generating the second firewall rule comprises: generating the second firewall rule to be applicable at a virtual network interface controller (VNIC) via which egress packets from a source virtualized computing instance supported by the source host are sent. ### Claim 13 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the generating the second firewall rule comprises: generating the second firewall rule to be applicable at a physical network interface controller (PNIC) via which egress packets from a source virtualized computing instance supported by the source host are sent. ### Claim 14 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the source host implements a firewall engine configurable by the computing device and the instructing the source host comprises: sending, to the firewall engine, a control message to configure the firewall engine to apply the second firewall rule to the egress packet at the source host. ### Claim 15 A computing device configured to implement a distributed firewall in a virtualized computing environment that includes a source host and a destination host, comprising: a processor; and a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to: retrieve a first firewall rule that is applicable at the destination host to an ingress packet destined for a destination virtualized computing instance supported by the destination host, wherein the first firewall rule is applicable at the destination host to drop the ingress packet having a set of packet fields; based on the first firewall rule, generate a second firewall rule that is applicable at the source host to an egress packet destined for the destination virtualized computing instance, wherein the second firewall rule is generated in addition to the first firewall rule, and applicable at the source host to drop the egress packet having the set of packet fields; and instruct the source host to apply the second firewall rule to, in response to the source host detecting the egress packet having the set of packet fields, drop the egress packet such that the egress packet is not sent from the source host to the destination host. ### Claim 16 (depends on 15) The computing device of claim 15, wherein the destination host implements a firewall engine configurable by the computing device, and prior to the retrieving the first firewall rule, the instructions further cause the processor to: receive, from the firewall engine of the destination host, a report message reporting the destination host applying the first firewall rule to block ingress packets from a source network address; and based on the source network address, select the source host to be instructed to apply the second firewall rule. ### Claim 17 (depends on 15) The computing device of claim 15, wherein, prior to the retrieving the first firewall rule, the instructions further cause the processor to: select the destination virtualized computing instance; and select multiple source virtualized computing instances supported by at least one source host to be instructed to apply the second firewall rule. ### Claim 18 (depends on 15) The computing device of claim 15, wherein the instructions for generating the second firewall rule further cause the processor to: based on the first firewall rule that specifies a pass action and a set of required packet fields, generate the second firewall rule to specify a drop action to drop the egress packet in response to the source host detecting the egress packet having the set of packet fields that do not satisfy the set of required packet fields specified by the first firewall rule. ### Claim 19 (depends on 15) The computing device of claim 15, wherein the instructions for generating the second firewall rule further cause the processor to: generate the second firewall rule to be applicable at a virtual network interface controller (VNIC) via which egress packets from a source virtualized computing instance supported by the source host are sent. ### Claim 20 (depends on 15) The computing device of claim 15, wherein the instructions for generating the second firewall rule further cause the processor to: generate the second firewall rule to be applicable at a physical network interface controller (PNIC) via which egress packets from a source virtualized computing instance supported by the source host are sent. ### Claim 21 (depends on 15) The computing device of claim 15, wherein the source host implements a firewall engine configurable by the computing device and the instructions for instructing the source host cause the processor to: send, to the firewall engine, a control message to configure the firewall engine to apply the second firewall rule to the egress packet at the source host.