crowbar/barclamp-network — pull request #269 by vuntz (2014-02-16 07:33:59+00:00)
Title: Enable netfilter on bridges

We were disabling it based on some documentation:
http://docs.openstack.org/admin-guide-cloud/content/ch_introduction-to-openstack-compute.html
("Packet loss from instances to nova-network server (VLANManager mode)") and

But it turns out this was misunderstood: the documentation was advising
to do it only on the nova-network node (which would be the neutron l3
node today). On the compute nodes, we absolutely need netfilter on
bridges to get security groups working.

For now, we simply enable this everywhere as, based on testing, this
doesn't seem to hurt us, and it should be safer this way on other nodes
too.