1. A system for filtering network access on host devices on which data compute nodes executes, the system comprising: a plurality of guest introspectors installed on a plurality of data compute nodes for capturing data regarding network access attempts on the data compute nodes; at least one service compute node (SCN) executing on each host devices; each host device's SCN for (i) receiving captured data regarding network access attempts from a set of guest introspectors on the host device, (ii) rejecting a network access attempt when a network access policy stored on the host device requires the rejection of the network access; and (iii) allowing a network access when no network access policy stored on the host device requires the rejection of the network access.