Apparatus and methods are provided for implementing a firewall in a network infrastructure component. A method comprises generating a search tree for a plurality of rules. The search tree comprises a first node having a first field bounds and a first set of rules of the plurality of rules, and a plurality of child nodes for the first node. Each child node has child field bounds based on an intersection of the first field bounds and the first set of rules, and each child node is assigned a respective subset of the first set of rules based on the respective child field bounds. The method further comprises receiving a first packet, identifying a first child node of the plurality of child nodes based on values for one or more fields of the first packet, and applying the respective subset of rules assigned to the first child node to the first packet.