US Patent 11012420 Third-party service chaining using packet encapsulation in a flow-based forwarding element

A method of enforcing security rules for a packet on a host is provided. The method at a security service dispatcher, determines a dispatching action on a packet for each of a group of security services. Each security service is for enforcing a set of security rules on each packet. The method for each security service, sends the packet to the security service when the dispatch rule for the security service indicates that the set of security rules of the security service has to be enforced on the packet. The method for each security service, bypasses the enforcement of the security rules of the security service when the dispatch rule for the security service indicates that the set of security rules of the security service has to be bypassed for the packet.