1. For a network controller that manages a flow-based managed forwarding element (MFE), a method comprising: receiving a plurality of service rules for implementation by the MFE, wherein each service rule matches over a set of network addresses, wherein at least one network address is in the set of network addresses for at least two service rules; grouping the network addresses into non-overlapping groups of network addresses, wherein each group of network addresses comprises addresses that are all matched by only a same set of service rules; and generating flow entries that match over the groups of network addresses for the MFE to use to implement the service rules.