[libvirt] iptables rules for a vm

Hello, I have kicked around an idea before with some of you about iptables...basically being able to have iptables rules that are associated with the metadata around a particular vm, then apply those to the host iptables when the vm is spun up or migrated to that host. I emailed with James he thinks the pieces are there but integration work is needed (as well as the central management). Would someone be willing to help me understand what major pieces of work would be needed to make this possible? Regards, Karl