Patent ID: 8151337

Claim:
A system for applying separate firewall rules to one or more networks connected to a computer, comprising: a computing device comprising a processor; and a memory coupled to said processor, said memory having stored thereon computer executable instructions that upon execution by the processor cause: instantiating on the computer an operating system shared by a first virtualized environment and a second virtualized environment that execute on the computer; instantiating on the computer a network stack comprising a filter engine, the filter engine storing a set of firewall rules, the filter engine being shared by the first and second virtualized environments; receiving, by a network interface card (NIC) associated with the network stack, a first data from one of the one or more networks; based on determining that the first data is directed to the first virtualized environment, modifying, by the NIC, the first data to identify the first virtualized environment; sending the modified first data from the NIC to the operating system; determining, by the operating system, based on the modified first data having been modified to identify the first virtualized environment, a first subset of the firewall rules; applying, by the filter engine, the first subset of the firewall rules to the first data to produce a filtered first data; sending the filtered first data to the first virtualized environment; receiving, by the NIC, a second data from one of the one or more networks; based on determining that the second data is directed to the second virtualized environment, modifying, by the NIC, the first data to identify the second virtualized environment; sending the modified second data from the NIC to the operating system; determining, by the operating system, based on the modified second data having been modified to identify the second virtualized environment, a second subset of the firewall rules; applying, by the filter engine, the second subset of the firewall rules to the second data to produce a filtered second data; and sending the filtered second data to the second virtualized environment.