Solved! something weird happened and I think it's a defect related to this kind of virtual environments with libvirt. Initially I though it was something specific to my setup but a colleague went through the exact same problem, so it's better to document it:

• In my host, there are 3 libvirt VMs (Openstack Controller, Compute and Storage).
• There is a virtual bridge called virbr0 ('default' network 192.168.122.x) that I was using as my 'provider' (external) network.

• The strange thing, was that the OS Compute VM inherited this virbr0 interface and related MASQUERADE rules from the host, exactly as they exist out there. This only happened in the compute node at some stage of the Openstack installation. So in my compute node, we have the virbr0 (in DOWN state) and these 'alien' iptables rules:

  MASQUERADE tcp -- 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 MASQUERADE udp -- 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 MASQUERADE all -- 192.168.122.0/24 !192.168.122.0/24

These rules were the ones causing the problem, as any external VM source IP in the 192.168.122.x range was trying to exit with the compute node's IP address.

Instead if deleting the rules, I just changed the provider network to another, new virtual network (other than the 'default' one) and everything works as expected.