Hey, looks like we fixed it, without any custom iptables rules. We followed this documented here: http://docs.openstack.org/folsom/openstack-network/admin/content/adv_cfg_l3_agent_metadata.html (http://docs.openstack.org/folsom/open...)

The page stated that the nova-metadata service must be reachable from the external network. Sense this is the case I updated the metadata ip in the nova.conf and the l3-agent.ini files to reflect the external ip address of the box that is running the metadata service. So in our case we were running the metadata service on the controller. After that, we restarted all of the nova-services and quantum services. We are now able to curl the following address from our vms: 'curl http://169.254.169.254/openstack'

As a reminder we had to add routes on the host that is running the metadata service that point back to the ip address of the l3 agent. For each private network that you create.

Example)

route add -net 192.168.4.0/24 gw 192.168.38.199 <---That .199 is the address of the l3 agent. route add -net 192.168.5.0/24 gw 192.168.38.199