Comment 1 for bug 1648664

Looks like that in Nova we rely on libvirtd to allocate a free port for each subsequent VM from the following range (configured in /etc/libvirt/qemu.conf on the compute nodes):

# Override the port for creating both VNC and SPICE sessions (min).
# This defaults to 5900 and increases for consecutive sessions
# or when ports are occupied, until it hits the maximum.
#
# Minimum must be greater than or equal to 5900 as lower number would
# result into negative vnc display number.
#
# Maximum must be less than 65536, because higher numbers do not make
# sense as a port number.
#
#remote_display_port_min = 5900
#remote_display_port_max = 65535

I.e. we would only need to tweak iptables rules.