1. A computer-implemented method comprising: receiving, at a driver executing in a guest operating system of a virtual machine (VM) operating on a physical host machine, a request to open a network connection from a process associated with a user, wherein the driver performs operations comprising: obtaining identity information for the user from the guest operating system of the VM, wherein the driver prevents transmission of any packets for the network connection until the identity information is obtained; and providing the identity information and data identifying the network connection to an identity module external to the driver and operating within virtualization software of the physical host machine; and at a firewall for the VM that operates within the virtualization software of the physical host machine: receiving, from the identity module, data associating source information for an outgoing packet from the VM with an identifier associated with one or more firewall rules, the identifier based on the identity information provided to the identity module by the driver; determining that the outgoing packet matches the associating data received from the identity module, based on a comparison between source information for the outgoing packet and source information in the associating data received from the identity module; and based at least in part on the identifier in the associating data received from the identity module, evaluating one or more firewall rules to identify a firewall rule that is applicable to the outgoing packet, said evaluating comprising comparing a set of header values of the outgoing packet with a set of packet-matching values of an evaluated firewall rule.