Interface-based acls in a layer-2 network

A system comprising:

• a physical network comprising:
• at least one first processor, the at least one processor is configured to:
• send a packet from source compute instance in a virtual network instantiated on the physical network to a destination compute instance via a destination virtual network interface card (destination VNIC) within a first virtual layer 2 network instantiated on the physical network;
• a network virtualization device, the network virtualization device configured to:
• instantiate a source VNIC, the source VNIC configured to:
• evaluate a access control list (ACL) for the packet;
• embed ACL information relevant to the packet in the packet;
• and
• forward the packet to a virtual switching and routing service (VSRS), the VSRS coupling a first virtual layer 2 network (VLAN) with a second network;
• at least one second processor, the at least one second processor configured to instantiate the VSRS, the VSRS configured to:
• identify the destination VNIC for delivery of the packet based on information received with the packet and mapping information contained within a mapping table;
• access the ACL information from the packet;
• apply the accessed ACL information to the packet.

A non-transitory computer-readable storage medium storing a plurality of instructions executable by one or more processors, the plurality of instructions when executed by the one or more processors cause the one or more processors to:

• send a packet from source compute instance in a virtual network to a destination compute instance via a destination virtual network interface card (destination VNIC) within a first virtual layer 2 network;
• evaluate an access control list (ACL) for the packet with a source virtual network interface card (source VNIC);
• embed ACL information relevant to the packet in the packet;
• forward the packet to a virtual switching and routing service (VSRS), the VSRS coupling a first virtual layer 2 network (VLAN) with a second network;
• identify with the VSRS the destination VNIC within the first virtual layer 2 network for delivery of the packet based on information received with the packet and mapping information contained within a mapping table;
• access with the VSRS the ACL information from the packet;
• apply the accessed ACL information to the packet.