A computing system comprising: one or more processors ; and one or more computer-readable storage media having stored thereon computer-executable instructions that are executable by the one or more processors to cause the computing system to create and/or operate a multi-gateway virtual machine that operates multiple gateways , each of the multiple gateways operating for a respective virtual network , such that the multi-gateway virtual machine operates gateways for a plurality of virtual networks , execution of the computer-executable instructions causing the computing system to perform a method of operation comprising the following for each of at least some packets that are received at the multi-gateway virtual machine : an act of the multi-gateway virtual machine accessing a corresponding encapsulated packet that contains a virtual network identifier corresponding to one of the plurality of virtual networks for which there is a corresponding gateway operating on the multi-gateway virtual machine ; an act of the multi-gateway virtual machine decapsulating the encapsulated packet ; an act of the multi-gateway virtual machine identifying the virtual network based on the virtual network identifier ; and an act of the multi-gateway virtual machine delivering the decapsulated packet to the corresponding gateway running for the identified virtual network , wherein it is controlled whether a policy for a processing capacity allocated to said virtual network is satisfied. one or more processors ; and one or more computer-readable storage media having stored thereon computer-executable instructions that are executable by the one or more processors to cause the computing system to create and/or operate a multi-gateway virtual machine that operates multiple gateways , each of the multiple gateways operating for a respective virtual network , such that the multi-gateway virtual machine operates gateways for a plurality of virtual networks , execution of the computer-executable instructions causing the computing system to perform a method of operation comprising the following for each of at least some packets that are received at the multi-gateway virtual machine : an act of the multi-gateway virtual machine accessing a corresponding encapsulated packet that contains a virtual network identifier corresponding to one of the plurality of virtual networks for which there is a corresponding gateway operating on the multi-gateway virtual machine ; an act of the multi-gateway virtual machine decapsulating the encapsulated packet ; an act of the multi-gateway virtual machine identifying the virtual network based on the virtual network identifier ; and an act of the multi-gateway virtual machine delivering the decapsulated packet to the corresponding gateway running for the identified virtual network , wherein it is controlled whether a policy for a processing capacity allocated to said virtual network is satisfied. an act of the multi-gateway virtual machine accessing a corresponding encapsulated packet that contains a virtual network identifier corresponding to one of the plurality of virtual networks for which there is a corresponding gateway operating on the multi-gateway virtual machine ; an act of the multi-gateway virtual machine decapsulating the encapsulated packet ; an act of the multi-gateway virtual machine identifying the virtual network based on the virtual network identifier ; and an act of the multi-gateway virtual machine delivering the decapsulated packet to the corresponding gateway running for the identified virtual network , wherein it is controlled whether a policy for a processing capacity allocated to said virtual network is satisfied. <EOS>