A packet processing method, wherein the method comprises: a) receiving, by a first network device, which comprises a Provider edge device PE, a first packet sent by a second network device, which comprises a customer premises equipment CPE connected to a first source device, wherein the first packet comprises a first group identifier which is comprised in an internet protocol version 6 IPv6 extension header of the first packet, the first group identifier corresponds to a virtual private network, VPN, on the second network device, the first source device corresponding to the first packet belongs to the VPN, and the first source device is connected to the second network device; b) obtaining, by the first network device, a second group identifier based on a destination address of the first packet, wherein the second group identifier corresponds to the VPN on a third network device, which comprises a CPE connected to a first destination device, the first destination device corresponding to the destination address of the first packet belongs to the VPN, and the first destination device is connected to the third network device; and c) processing, by the first network device, the first packet based on the first group identifier and the second group identifier by: • obtaining, by the first network device, a first processing policy based on the first group identifier and the second group identifier; and • processing, by the first network device, the first packet based on the first processing policy by: - sending, by the first network device, the first packet to the third network device when the first processing policy indicates that a transmission direction from the second network device to the third network device is connected; or - discarding, by the first network device, the first packet when the first processing policy indicates that the transmission direction from the second network device to the third network device is isolated. a) receiving, by a first network device, which comprises a Provider edge device PE, a first packet sent by a second network device, which comprises a customer premises equipment CPE connected to a first source device, wherein the first packet comprises a first group identifier which is comprised in an internet protocol version 6 IPv6 extension header of the first packet, the first group identifier corresponds to a virtual private network, VPN, on the second network device, the first source device corresponding to the first packet belongs to the VPN, and the first source device is connected to the second network device; b) obtaining, by the first network device, a second group identifier based on a destination address of the first packet, wherein the second group identifier corresponds to the VPN on a third network device, which comprises a CPE connected to a first destination device, the first destination device corresponding to the destination address of the first packet belongs to the VPN, and the first destination device is connected to the third network device; and c) processing, by the first network device, the first packet based on the first group identifier and the second group identifier by: • obtaining, by the first network device, a first processing policy based on the first group identifier and the second group identifier; and • processing, by the first network device, the first packet based on the first processing policy by: - sending, by the first network device, the first packet to the third network device when the first processing policy indicates that a transmission direction from the second network device to the third network device is connected; or - discarding, by the first network device, the first packet when the first processing policy indicates that the transmission direction from the second network device to the third network device is isolated. • obtaining, by the first network device, a first processing policy based on the first group identifier and the second group identifier; and • processing, by the first network device, the first packet based on the first processing policy by: - sending, by the first network device, the first packet to the third network device when the first processing policy indicates that a transmission direction from the second network device to the third network device is connected; or - discarding, by the first network device, the first packet when the first processing policy indicates that the transmission direction from the second network device to the third network device is isolated. - sending, by the first network device, the first packet to the third network device when the first processing policy indicates that a transmission direction from the second network device to the third network device is connected; or - discarding, by the first network device, the first packet when the first processing policy indicates that the transmission direction from the second network device to the third network device is isolated.