1. For a network controller that manages a flow-based managed forwarding element (MFE), a method comprising: receiving a plurality of service rules for implementation by the MFE, wherein each service rule matches over a set of network addresses, wherein at least one network address is in the set of network addresses for at least two service rules; grouping the network addresses into non-overlapping groups of network addresses, wherein each group of network addresses comprises addresses that are all matched by only a same set of service rules; and generating flow entries that match over the groups of network addresses for the MFE to use to implement the service rules, wherein said receiving, grouping, and generating is performed by the network controller, which is executed by a set of hardware processing units on a computer.