Firewalls in logical networks

A non-transitory machine readable medium storing a firewall application for execution by at least one processing unit of a physical host computer, the firewall application comprising sets of instructions for:

• receiving a packet from a managed forwarding element executing on the physical host computer;
• identifying which of a plurality of sets of processing rules enforced by the firewall application applies to the packet, wherein:
• (i) each set of processing rules of the plurality of sets of processing rules corresponds to a different one of a plurality of distributed firewalls;
• (ii) each distributed firewall of the plurality of distributed firewalls is associated with a different one of a plurality of logical networks;
• (iii) each respective logical network of the plurality of logical networks logically connects a respective set of end machines that operate on the physical host computer with other end machines that operate on a respective plurality of other physical host computers and that are connected to the respective logical network;
• (iv) each respective logical network is implemented by a respective plurality of managed forwarding elements executing on the respective plurality of physical host computers on which at least one end machine connected to the respective logical network operates
• (v) for each respective logical network, the respective set of processing rules corresponding to the respective distributed firewall associated with the respective logical network is enforced by the firewall application executing on the physical host computer and by firewall applications executing on each of the other physical host computers on which at least one end machine connected to the respective logical network operates;
• and
• (vi) identifying which of the plurality of sets of processing rules enforced by the firewall application applies to the packet comprises determining which of the plurality of logical networks the packet is traversing;
• determining whether to allow the packet based on the identified set of processing rules;
• and
• when the packet is allowed, sending the packet back to the managed forwarding element executing on the physical host computer.