1. A method to control the flow of packets through a firewall that is implemented in a system that includes one or more computer networks comprising: storing policy rules in machine readable storage media that set forth attribute dependent conditions for communications among machines on the one or more computer networks; obtaining respective machine attributes and corresponding machine identifiers for respective machines on the one or more computer networks; transforming the policy rules to firewall rules that include machine identifiers of machines having attributes from among the obtained machine attributes that satisfy the attribute dependent policy rules, wherein transforming the policy rules to firewall rules further includes: matching an attribute condition within a policy rule with one or more obtained machine attributes; generating at least one firewall rule for each machine identifier of a machine having all machine attributes required to satisfy the attribute condition within the policy rule; resolving at least one set operation within the attribute condition to produce a resolved attribute condition; and generating at least one firewall rule for each machine identifier of a machine having all attributes required to satisfy the resolved attribute condition within the policy rule; storing the firewall rules in machine readable storage media; and filtering communications from and to a first machine on the one or more computer networks and communications from and to a second machine on the one or more computer networks at the firewall according to the firewall rules.