Nova should not assume the default iptables INPUT filter policy is accept

On systems where the default policy for the iptables INPUT filter is DROP, I'm seeing DNS, DHCP and EC2 metadata requests being dropped.

Something similar to:

  $> sudo iptables -t filter -A nova-network-INPUT \
                   -s 0.0.0.0/0 -d $ec2_dmz_host \
                   -m tcp -p tcp --dport $ec2_port -j ACCEPT
   $> sudo iptables -t filter -A nova-network-INPUT -i br0 -p udp -m udp --dport 67 -j ACCEPT
   $> sudo iptables -t filter -A nova-network-INPUT -i br0 -p tcp -m tcp --dport 67 -j ACCEPT
   $> sudo iptables -t filter -A nova-network-INPUT -i br0 -p udp -m udp --dport 53 -j ACCEPT
   $> sudo iptables -t filter -A nova-network-INPUT -i br0 -p tcp -m tcp --dport 53 -j ACCEPT

fixes it for me

To explain fully, this on Fedora where the the default policy is actually ACCEPT but the last rule in the INPUT chain is:

  -A INPUT -j REJECT --reject-with icmp-host-prohibited