Revision history [back]

http://docs.openstack.org/admin-guide-cloud/content/section_allowed_address_pairs_workflow.html

This will allow you to specify CIDRs allowed to leave the port. It would appear you can omit the mac as well.