A method for processing network packets for a virtual machine executing at a computer system, the computer system including one or more processors and system memory, the computer system also including a physical network interface card, NIC, and executing a host partition, the method comprising: an act of a virtual switch in the host partition maintaining a plurality of rule sets (106a; 106b) for a virtual machine, the virtual switch including a plurality of layers (502, 504) of rule sets, each layer including an independent set of rule sets; an act of the physical NIC maintaining one or more flow tables (112a; 112b) for the virtual machine; an act of the physical NIC receiving a network packet associated with the virtual machine; and an act of processing the network packet for the virtual machine, including: an act of the physical NIC comparing the network packet with the one or more flow tables, when the network packet matches with a flow in the one or more flow tables, an act of the physical NIC performing an action on the network packet based on the matching flow, when the network packet does not match with a flow in the one or more flow tables, an act of the physical NIC passing the network packet to the host partition for processing against the plurality of rule sets, and when the network packet does not match with a flow in the one or more flow tables, an act of the virtual switch in the host partition comparing the network packet with a rule of the plurality of rule sets, including the network packet traversing the layers and each layer matching the network packet with its own rule set. an act of a virtual switch in the host partition maintaining a plurality of rule sets (106a; 106b) for a virtual machine, the virtual switch including a plurality of layers (502, 504) of rule sets, each layer including an independent set of rule sets; an act of the physical NIC maintaining one or more flow tables (112a; 112b) for the virtual machine; an act of the physical NIC receiving a network packet associated with the virtual machine; and an act of processing the network packet for the virtual machine, including: an act of the physical NIC comparing the network packet with the one or more flow tables, when the network packet matches with a flow in the one or more flow tables, an act of the physical NIC performing an action on the network packet based on the matching flow, when the network packet does not match with a flow in the one or more flow tables, an act of the physical NIC passing the network packet to the host partition for processing against the plurality of rule sets, and when the network packet does not match with a flow in the one or more flow tables, an act of the virtual switch in the host partition comparing the network packet with a rule of the plurality of rule sets, including the network packet traversing the layers and each layer matching the network packet with its own rule set. an act of the physical NIC comparing the network packet with the one or more flow tables, when the network packet matches with a flow in the one or more flow tables, an act of the physical NIC performing an action on the network packet based on the matching flow, when the network packet does not match with a flow in the one or more flow tables, an act of the physical NIC passing the network packet to the host partition for processing against the plurality of rule sets, and when the network packet does not match with a flow in the one or more flow tables, an act of the virtual switch in the host partition comparing the network packet with a rule of the plurality of rule sets, including the network packet traversing the layers and each layer matching the network packet with its own rule set.