OVS is a virtual switch (openvswitch), not a router. You can set it up to bridge two VLANs, but that passes all traffic from one to the other - and then you might as well not be using VLANs to segregate the traffic at all.
You need a router somewhere that has ports open on each VLAN, and then that router can make layer-3 decisions about passing traffic between the VLANs. Your firewall is essentially that router - in fact, almost all firewalls in existence are essentially just routers with some form of ACL and/or packet filtering rules running on them.
In large virtual deployments where routing between virtual networks is required you'll find "v-routers" installed, which are essentially just VMs with ports open on each virtual network segment and doing the routing function between them. There are still free versions of vyoss (vyatta) around that can do this pretty well.