Where does the Distributed Logical Firewall enforce firewall rules?

Where does the Distributed Logical Firewall enforce firewall rules?

A.
At the Virtual Machine’s virtual Network Interface Card (vNIC).

B.
At the Logical Switch virtual port that the Virtual Machine connects to.

C.
At the NSX Controller’s firewall kernel module.

D.
At the ESXi host vmnic used by the vSphere Distributed Switch.