As admin:

nova secgroup-list --all-tenants

You can also specify security groups when you start an instance:

nova boot --security-groups <list of security groups> .... <name of instance>

And list the security groups of an instance:

nova list-secgroup <instance name or id>

Finally you may want to get console access to your instances to check their iptables setting.