A method for forwarding a packet, comprising: receiving (S401, S501), by a first network virtualization edge, NVE, a first packet sent by a first tenant end system, TES, wherein a destination Internet Protocol, IP, address of the first packet is an IP address of a second TES, a destination media access control, MAC, address of the first packet is a gateway MAC address corresponding to the first NVE, and the first TES and the second TES belong to a same layer 3 virtual private network, VPN; acquiring (S402, S502), by the first NVE, an access virtual network identifier, VN ID, of the first TES according to at least one of information about a port receiving the first packet and the first packet; acquiring(S402, S502), by the first NVE, a layer 3 VPN instance identifier of the first TES according to the access VN ID of the first TES; performing (S403, S503), by the first NVE, layer 2 termination on the first packet; the method being characterized in that it further comprises: searching, according to the IP address of the second TES, a routing and forwarding table corresponding to the layer 3 VPN instance identifier of the first TES, to obtain an entry corresponding to the IP address of the second TES; wherein the entry comprises the IP address of the second TES, an IP address of the second NVE to which the second TES is connected, a gateway MAC address corresponding to the second NVE, and a global VN ID corresponding to a layer 3 VPN instance identifier of the second TES; encapsulating the first packet into a network virtualization overlays, NVO3, packet according to the entry; and forwarding (S404, S505), by the first NVE, the NVO3 packet to a second NVE by using a layer 3 network, wherein the second TES is connected to the second NVE. receiving (S401, S501), by a first network virtualization edge, NVE, a first packet sent by a first tenant end system, TES, wherein a destination Internet Protocol, IP, address of the first packet is an IP address of a second TES, a destination media access control, MAC, address of the first packet is a gateway MAC address corresponding to the first NVE, and the first TES and the second TES belong to a same layer 3 virtual private network, VPN; acquiring (S402, S502), by the first NVE, an access virtual network identifier, VN ID, of the first TES according to at least one of information about a port receiving the first packet and the first packet; acquiring(S402, S502), by the first NVE, a layer 3 VPN instance identifier of the first TES according to the access VN ID of the first TES; performing (S403, S503), by the first NVE, layer 2 termination on the first packet; the method being characterized in that it further comprises: searching, according to the IP address of the second TES, a routing and forwarding table corresponding to the layer 3 VPN instance identifier of the first TES, to obtain an entry corresponding to the IP address of the second TES; wherein the entry comprises the IP address of the second TES, an IP address of the second NVE to which the second TES is connected, a gateway MAC address corresponding to the second NVE, and a global VN ID corresponding to a layer 3 VPN instance identifier of the second TES; encapsulating the first packet into a network virtualization overlays, NVO3, packet according to the entry; and forwarding (S404, S505), by the first NVE, the NVO3 packet to a second NVE by using a layer 3 network, wherein the second TES is connected to the second NVE. searching, according to the IP address of the second TES, a routing and forwarding table corresponding to the layer 3 VPN instance identifier of the first TES, to obtain an entry corresponding to the IP address of the second TES; wherein the entry comprises the IP address of the second TES, an IP address of the second NVE to which the second TES is connected, a gateway MAC address corresponding to the second NVE, and a global VN ID corresponding to a layer 3 VPN instance identifier of the second TES; encapsulating the first packet into a network virtualization overlays, NVO3, packet according to the entry; and forwarding (S404, S505), by the first NVE, the NVO3 packet to a second NVE by using a layer 3 network, wherein the second TES is connected to the second NVE.