> ovs 2.5 support conntrack and openstack have commited their ovs firewall (no > iptables, no bridge on top of ovs) Yes, that would be an interesting optimization. I guess we can get rid of the additional bridge? If so, can we do the same for linux bridge?