Comment 7 for bug 579868

I second Tony Maro: 10.10 does not add any masquerading for the node controllers.
A quick workaround that works for me is adding in /etc/rc.local:

iptables -t nat -A POSTROUTING -s 192.168.42.0/24 -o eth1 -j MASQUERADE
iptables-save> /var/run/eucalyptus/net/iptables-preload

Here, my node controllers are in the .42.0/24 private network, using the CC as gateway (CC is connected to the network via eth0).
Eth1 of the CC is connected to the outside word.