Security Groups with multi_host=F

Greetings,

I'm running an essex install on scientific linux 6.3. The configuration is currently a single master and a single compute node. I'm trying to run with multi_host=F. I'm seeing that the security group rules are being applied as iptable rules on the compute node not the network node. I don't think this will work, since the VM is connected directly to the bridge, so the iptable rules don't matter. I can see how this would work on a multi_host=T configuration, but not a multi_host=F. It is possible I pooched the configuration somehow, but everything else is working correctly. Looking through the code, I can't see how the network node will get the trigger to refresh and set the filter rules for the security group.