A flow table processing method implemented in a software-defined networking, SDN, comprising a security group with M virtual machine ports and N rules, wherein both M and N are integers greater than 0, comprising: generating, by an SDN controller, a first matching flow table set comprising at least M port matching flow tables corresponding to the M virtual machine ports, each virtual machine port corresponds to at least one port matching flow table, and each port matching flow table comprises port matching information and an identifier of the security group; sending, by the SDN controller, the first matching flow table set, to a switching device of the SDN; generating, by the SDN controller, a second matching flow table set comprising at least N rule matching flow tables corresponding to the N rules, each rule corresponds to at least one rule matching flow table, and each rule matching flow table comprises rule matching information and the identifier of the security group; sending, by the SDN controller, the second matching flow table set, to the switching device; generating, by the SDN controller, an action flow table comprising the identifier of the security group and a packet action, the packet action indicates an operation that is executed after a packet matches the security group; and sending, by the SDN controller, the action flow table to the switching device; wherein the packet matches the security group when the packet matches any port matching flow table in the first matching flow table set and matches any rule matching flow table in the second matching flow table set; and each port matching flow table further comprises a first connection identifier, the first connection identifier is used to indicate that security group matching of the packet comprises two parts, and a first part of security group matching of the packet is completed when the packet matches any port matching flow table in the first matching flow table set; and each rule matching flow table further comprises a second connection identifier, the second connection identifier is used to indicate that security group matching of the packet comprises two parts, and a second part of security group matching of the packet is completed when the packet matches any rule matching flow table in the second matching flow table set. generating, by an SDN controller, a first matching flow table set comprising at least M port matching flow tables corresponding to the M virtual machine ports, each virtual machine port corresponds to at least one port matching flow table, and each port matching flow table comprises port matching information and an identifier of the security group; sending, by the SDN controller, the first matching flow table set, to a switching device of the SDN; generating, by the SDN controller, a second matching flow table set comprising at least N rule matching flow tables corresponding to the N rules, each rule corresponds to at least one rule matching flow table, and each rule matching flow table comprises rule matching information and the identifier of the security group; sending, by the SDN controller, the second matching flow table set, to the switching device; generating, by the SDN controller, an action flow table comprising the identifier of the security group and a packet action, the packet action indicates an operation that is executed after a packet matches the security group; and sending, by the SDN controller, the action flow table to the switching device; wherein the packet matches the security group when the packet matches any port matching flow table in the first matching flow table set and matches any rule matching flow table in the second matching flow table set; and each port matching flow table further comprises a first connection identifier, the first connection identifier is used to indicate that security group matching of the packet comprises two parts, and a first part of security group matching of the packet is completed when the packet matches any port matching flow table in the first matching flow table set; and each rule matching flow table further comprises a second connection identifier, the second connection identifier is used to indicate that security group matching of the packet comprises two parts, and a second part of security group matching of the packet is completed when the packet matches any rule matching flow table in the second matching flow table set.