Да, ovs умеет в acl, называются они в нем flow, пример у меня получился такой:
ovs-ofctl add-flow ovs-br "cookie=0x00, table=0, in_port=eth0, action=normal"
ovs-ofctl add-flow ovs-br "cookie=0x01, table=0, in_port=ovs-br, action=normal"
ovs-ofctl add-flow ovs-br "cookie=0x08, table=0, icmp6, ipv6_src=fe80::/64, ipv6_dst=ff02::/96, action=normal"
ovs-ofctl add-flow ovs-br "cookie=0x09, table=0, arp, action=normal"
ovs-ofctl add-flow ovs-br "cookie=0x10, table=0, ip, nw_src=<ipv4 subnet>, nw_dst=<ipv4 subnet>, actions=drop"
ovs-ofctl add-flow ovs-br "cookie=0x11, table=0, ip, nw_src=<ipv4 subnet>, actions=normal"
ovs-ofctl add-flow ovs-br "cookie=0x12, table=0, ipv6, ipv6_src=<ipv6 subnet>, ipv6_dst=<ipv6 subnet>, action=drop"
ovs-ofctl add-flow ovs-br "cookie=0x13, table=0, ipv6_src=<ipv6 subnet>, ipv6, action=normal"
