Firewall in a virtualized computing environment using physical network interface controller (PNIC) level firewall rules
Example methods are provided for a destination host to implement a firewall in a virtualized computing environment that includes the destination host and a source host. The method may comprise receiving, via a physical network interface controller (PNIC) of the destination host, an ingress packet sent by the source host. The ingress packet may be destined for a destination virtualized computing instance that is supported by the destination host and associated with a destination virtual network interface controller (VNIC). The method may further comprise retrieving a PNIC-level firewall rule associated with the destination virtualized computing instance, the PNIC-level firewall rule being applicable at the PNIC and generated by based on a VNIC-level firewall rule applicable at the destination VNIC. In response to determination that the PNIC-level firewall rule blocks the ingress packet from passing through, the ingress packet may be dropped such that the ingress packet is not sent to the destination VNIC.
1. A method for a destination host to implement a firewall in a virtualized computing environment that includes the destination host and a source host, the method comprising:
receiving, via a physical network interface controller (PNIC) of the destination host, an ingress packet sent by the source host, wherein the ingress packet is addressed to a destination address, and a destination virtualized computing instance supported by the destination host is associated with the destination address and a destination virtual network interface controller (VNIC);
retrieving a PNIC-level firewall rule associated with the destination virtualized computing instance, wherein the PNIC-level firewall rule is applicable at the PNIC and generated based on a VNIC-level firewall rule applicable at the destination VNIC, and the VNIC-level firewall rule specifies a destination address field that matches with the destination address of the ingress packet; and
in response to determination that the PNIC-level firewall rule blocks the ingress packet from passing through, dropping the ingress packet such that the ingress packet is not sent to the destination VNIC.
2. The method of claim 1 , wherein the method further comprises:
generating the PNIC-level firewall rule by aggregating multiple VNIC-level firewall rules that include the VNIC-level firewall rule applicable at the destination VNIC.
3. The method of claim 2 , wherein the generating the PNIC-level firewall rule comprises:
analyzing the VNIC-level firewall rule applicable at the destination VNIC and at least one other VNIC-level firewall rule to identify one or more combinable packet fields; and
based on the one or more combinable packet fields, synthesizing the VNIC-level firewall rule applicable at the destination VNIC and the at least one other VNIC-level firewall rule to generate the PNIC-level firewall rule.
4. The method of claim 3 , wherein the packet fields include one or more of: source Internet Protocol (IP) address, source port number, destination IP address, destination protocol number, protocol and action.
5. The method of claim 1 , wherein the destination host implements a distributed firewall engine that is configurable by a firewall controller and the method further comprises:
in response to receiving a control message from the firewall controller, configuring the firewall engine to apply the PNIC-level firewall rule at the PNIC instead of applying the VNIC-level firewall rule at the destination VNIC.
6. The method of claim 5 , wherein the PNIC-level firewall rule specified in the control message is generated by the firewall controller by aggregating the multiple VNIC-level firewall rules.
7. A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a destination host, cause the processor to perform a method to implement a firewall in a virtualized computing environment that includes the destination host and a source host, the method comprising:
receiving, via a physical network interface controller (PNIC) of the destination host, an ingress packet sent by the source host, wherein the ingress packet is addressed to a destination address, and a destination virtualized computing instance supported by the destination host is associated with the destination address and a destination virtual network interface controller (VNIC);
retrieving a PNIC-level firewall rule associated with the destination virtualized computing instance, wherein the PNIC-level firewall rule is applicable at the PNIC and generated based on a VNIC-level firewall rule applicable at the destination VNIC, and the VNIC-level firewall rule specifies a destination address field that matches with the destination address of the ingress packet; and
in response to determination that the PNIC-level firewall rule blocks the ingress packet from passing through, dropping the ingress packet such that the ingress packet is not sent to the destination VNIC.
8. The non-transitory computer-readable storage medium of claim 7 , wherein the method further comprises:
generating the PNIC-level firewall rule by aggregating multiple VNIC-level firewall rules that include the VNIC-level firewall rule applicable at the destination VNIC.
9. The non-transitory computer-readable storage medium of claim 8 , wherein the generating the PNIC-level firewall rule comprises:
analyzing the VNIC-level firewall rule applicable at the destination VNIC and at least one other VNIC-level firewall rule to identify one or more combinable packet fields; and
based on the one or more combinable packet fields, synthesizing the VNIC-level firewall rule applicable at the destination VNIC and the at least one other VNIC-level firewall rule to generate the PNIC-level firewall rule.
10. The non-transitory computer-readable storage medium of claim 9 , wherein the packet fields include one or more of: source Internet Protocol (IP) address, source port number, destination IP address, destination protocol number, protocol and action.
11. The non-transitory computer-readable storage medium of claim 7 , wherein the destination host implements a distributed firewall engine that is configurable by a firewall controller and the method further comprises:
in response to receiving a control message from the firewall controller, configuring the firewall engine to apply the PNIC-level firewall rule at the PNIC instead of applying the VNIC-level firewall rule at the destination VNIC.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the PNIC-level firewall rule specified in the control message is generated by the firewall controller by aggregating multiple VNIC-level firewall rules.
13. A host, being a destination host, configured to implement a firewall in a virtualized computing environment that includes the destination host and a source host, comprising:
a processor;
a physical network interface controller (PNIC); and
a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to:
receive, via the PNIC, an ingress packet sent by the source host, wherein the ingress packet addressed to a destination address, and a destination virtualized computing instance supported by the destination host is associated with the destination address and a destination virtual network interface controller (VNIC);
retrieve a PNIC-level firewall rule associated with the destination virtualized computing instance, wherein the PNIC-level firewall rule is applicable at the PNIC and generated based on a VNIC-level firewall rule applicable at the destination VNIC, and the VNIC-level firewall rule specifies a destination address field that matches with the destination address of the ingress packet; and
in response to determination that the PNIC-level firewall rule blocks the ingress packet from passing through, drop the ingress packet such that the ingress packet is not sent to the destination VNIC.
14. The host of claim 13 , wherein the instructions further cause the processor to:
generate the PNIC-level firewall rule by aggregating multiple VNIC-level firewall rules.
15. The host of claim 14 , wherein the instructions for generating the PNIC-level firewall rule cause the processor to:
analyze the VNIC-level firewall rule applicable at the destination VNIC and at least one other VNIC-level firewall rule to identify one or more combinable packet fields; and
based on the one or more combinable packet fields, synthesize the VNIC-level firewall rule applicable at the destination VNIC and the at least one other VNIC-level firewall rule to generate the PNIC-level firewall rule.
16. The host of claim 15 , wherein the packet fields include one or more of:
source Internet Protocol (IP) address, source port number, destination IP address, destination protocol number, protocol and action.
17. The host of claim 13 , wherein the destination host implements a distributed firewall engine that is configurable by a firewall controller and the instructions further cause the processor to:
in response to receiving a control message from the firewall controller, configure the firewall engine to apply the PNIC-level firewall rule at the PNIC instead of applying the VNIC-level firewall rule at the destination VNIC.
18. The host of claim 17 , wherein the PNIC-level firewall rule specified in the control message is generated by the firewall controller by aggregating multiple VNIC-level firewall rules.