just found this: http://openvswitch.org/support/ovscon2014/17/1030-conntrack_nat.pdf I'll try to look at this in the next months. (ovs firewall without iptables/bridge trick)