Comment 2 for bug 1248859

you need to config firewall_driver = nova.virt.libvirt.firewall.IptablesFirewallDriver, unfortunately a default devstack install now config it as firewall_driver="nova.virt.firewall.NoopFirewallDriver when using Neutron. so this may be a devstack bug.