When a subnet is attached to a router, l3 vpn flows are installed for the subnet's instances.

Some of these flows such as ACL vpn are not removed if the subnet is unattached from the routers.

Reproduction steps:

1) create NET/SUBNET

2) create instance VM

3) create router ROUTER

4) attach SUBNET to ROUTER, notice vpn flows are installed for SUBNET

5) unattach SUBNET from ROUTER, some flows installled in 4) remain but should have been removed

For example

Flows installed when subnet attaches to the router (vpnid=0x30d40) in step 4)

 cookie=0x6900000, table=17, priority=10,metadata=0x10000000000/0xffffff0000000000 actions=write_metadata:0x8000010000030d40/0xfffffffffffffffe,goto_table:211
 cookie=0x8000001, table=17, priority=10,metadata=0x8000010000000000/0xffffff0000000000 actions=load:0x186a0->NXM_NX_REG3[0..24],write_metadata:0x9000010000030d40/0xfffffffffffffffe,goto_table:19
 cookie=0x8000009, table=19, priority=20,metadata=0x30d40/0xfffffe,dl_dst=fa:16:3e:09:f7:c7 actions=goto_table:21
 cookie=0x8000003, table=21, priority=42,icmp,metadata=0x30d40/0xfffffe,nw_dst=10.100.5.1,icmp_type=8,icmp_code=0 actions=move:NXM_OF_ETH_SRC[]>NXM_OF_ETH_DST[],set_field:fa:16:3e:09:f7:c7>eth_src,move:NXM_OF_IP_SRC[]>NXM_OF_IP_DST[],set_field:10.100.5.1>ip_src,set_field:0->icmp_type,load:0->NXM_OF_IN_PORT[],resubmit(,21)
 cookie=0x8000003, table=21, priority=42,ip,metadata=0x30d40/0xfffffe,nw_dst=10.100.5.13 actions=group:150000
 cookie=0x8000004, table=21, priority=10,ip,metadata=0x30d40/0xfffffe actions=goto_table:26
 cookie=0x8000006, table=26, priority=5,ip,metadata=0x30d40/0xfffffe actions=goto_table:46
 cookie=0x8000005, table=36, priority=10,ip,tun_id=0x11170 actions=write_metadata:0x30d40/0xfffffe,goto_table:46
 cookie=0x81286a9, table=46, priority=5,ip,metadata=0x30d40/0xfffffe actions=CONTROLLER:65535,write_metadata:0x30d40/0xfffffe
 cookie=0x8000006, table=47, priority=5,ip,metadata=0x30d40/0xfffffe actions=load:0->NXM_OF_IN_PORT[],resubmit(,21)
 cookie=0x6900000, table=212, priority=50,ip,metadata=0x30d40/0xfffffe,nw_dst=10.100.5.13 actions=write_metadata:0x2/0xfffffe,goto_table:213
 cookie=0x6900000, table=212, priority=50,ipv6,metadata=0x30d40/0xfffffe,ipv6_dst=fe80::f816:3eff:febb:2b31 actions=write_metadata:0x2/0xfffffe,goto_table:213
 cookie=0x6900000, table=220, priority=6,reg6=0x100 actions=load:0x90000100->NXM_NX_REG6[],write_metadata:0x30d40/0xfffffffffe,goto_table:239
 cookie=0x6900000, table=242, priority=50,ip,metadata=0x30d40/0xfffffe,nw_src=10.100.5.13 actions=write_metadata:0x2/0xfffffe,goto_table:243
 cookie=0x6900000, table=242, priority=50,ipv6,metadata=0x30d40/0xfffffe,ipv6_src=fe80::f816:3eff:febb:2b31 actions=write_metadata:0x2/0xfffffe,goto_table:243

Flows remain after step 5) but should have been removed after unattaching subnet from the router i

 cookie=0x8000003, table=21, priority=42,icmp,metadata=0x30d40/0xfffffe,nw_dst=10.100.5.1,icmp_type=8,icmp_code=0 actions=move:NXM_OF_ETH_SRC[]>NXM_OF_ETH_DST[],set_field:fa:16:3e:09:f7:c7>eth_src,move:NXM_OF_IP_SRC[]>NXM_OF_IP_DST[],set_field:10.100.5.1>ip_src,set_field:0->icmp_type,load:0->NXM_OF_IN_PORT[],resubmit(,21)
 cookie=0x6900000, table=212, priority=50,ip,metadata=0x30d40/0xfffffe,nw_dst=10.100.5.13 actions=write_metadata:0x2/0xfffffe,goto_table:213
 cookie=0x6900000, table=212, priority=50,ipv6,metadata=0x30d40/0xfffffe,ipv6_dst=fe80::f816:3eff:febb:2b31 actions=write_metadata:0x2/0xfffffe,goto_table:213
 cookie=0x6900000, table=242, priority=50,ip,metadata=0x30d40/0xfffffe,nw_src=10.100.5.13 actions=write_metadata:0x2/0xfffffe,goto_table:243
 cookie=0x6900000, table=242, priority=50,ipv6,metadata=0x30d40/0xfffffe,ipv6_src=fe80::f816:3eff:febb:2b31 actions=write_metadata:0x2/0xfffffe,goto_table:243