A flow table processing method, comprising: generating, by a software-defined networking, SDN, controller, a first matching flow table set of a security group, wherein M virtual machine ports have been added to the security group, the first matching flow table set comprises at least M port matching flow tables corresponding to the M virtual machine ports, each virtual machine port corresponds to at least one port matching flow table, each port matching flow table comprises port matching information and an identifier of the security group, and M is an integer greater than 0; generating, by the SDN controller, a second matching flow table set, wherein the security group comprises N rules, the second matching flow table set comprises at least N rule matching flow tables corresponding to the N rules, each rule corresponds to at least one rule matching flow table, each rule matching flow table comprises rule matching information and the identifier of the security group, and N is an integer greater than 0; generating, by the SDN controller, an action flow table of the security group, wherein the action flow table of the security group comprises the identifier of the security group and a packet action, the packet action indicates an operation that is executed after a packet successfully matches the security group, and that a packet successfully matches the security group comprises: the packet matches any port matching flow table in the first matching flow table set, and matches any rule matching flow table in the second matching flow table set; and sending, by the SDN controller, the first matching flow table set, the second matching flow table set, and the action flow table of the security group to a switching device; wherein each port matching flow table further comprises a first connection identifier, the first connection identifier is used to indicate that security group matching of the packet comprises two parts, and a first part of security group matching of the packet is completed when the packet matches any port matching flow table in the first matching flow table set; and each rule matching flow table further comprises a second connection identifier, the second connection identifier is used to indicate that security group matching of the packet comprises two parts, and a second part of security group matching of the packet is completed when the packet matches any rule matching flow table in the second matching flow table set. generating, by a software-defined networking, SDN, controller, a first matching flow table set of a security group, wherein M virtual machine ports have been added to the security group, the first matching flow table set comprises at least M port matching flow tables corresponding to the M virtual machine ports, each virtual machine port corresponds to at least one port matching flow table, each port matching flow table comprises port matching information and an identifier of the security group, and M is an integer greater than 0; generating, by the SDN controller, a second matching flow table set, wherein the security group comprises N rules, the second matching flow table set comprises at least N rule matching flow tables corresponding to the N rules, each rule corresponds to at least one rule matching flow table, each rule matching flow table comprises rule matching information and the identifier of the security group, and N is an integer greater than 0; generating, by the SDN controller, an action flow table of the security group, wherein the action flow table of the security group comprises the identifier of the security group and a packet action, the packet action indicates an operation that is executed after a packet successfully matches the security group, and that a packet successfully matches the security group comprises: the packet matches any port matching flow table in the first matching flow table set, and matches any rule matching flow table in the second matching flow table set; and sending, by the SDN controller, the first matching flow table set, the second matching flow table set, and the action flow table of the security group to a switching device;