prelim testing done. Things look to be working correctly. Subvert still gets around the firewall because now that the rule doesn't get installed, all of its packets get forwarded to the controller. Without the packet out getting checked against the flow rules on the switch, all packets get through without having to get matched on a flowtable rule