diff --git a/defaults/main.yml b/defaults/main.yml
index 87ca0d56..8b172e33 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -405,6 +405,13 @@ neutron_service_in_ldap: false
 # neutron_local_ip is used for the VXLAN local tunnel endpoint
 neutron_local_ip: 127.0.0.1
 
+# When running in an AIO, we need to implement an iptables rule in any
+# neutron_agent containers to that ensure instances can communicate with
+# the neutron metadata service. This is necessary because in an AIO
+# environment there are no physical interfaces involved in instance ->
+# metadata requests, and this results in the checksums being incorrect.
+neutron_metadata_checksum_fix: False
+
 # neutron packages that must be installed before anything else
 neutron_requires_pip_packages:
   - virtualenv
diff --git a/files/post-up-metadata-checksum b/files/post-up-metadata-checksum
new file mode 100644
index 00000000..0e3705a3
--- /dev/null
+++ b/files/post-up-metadata-checksum
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Copyright 2016, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# NOTICE:
+# When running in an AIO, we need to drop the following iptables rule in any
+# neutron_agent containers to that ensure instances can communicate with the
+# neutron metadata service. This is necessary because in an AIO environment
+# there are no physical interfaces involved in instance -> metadata requests,
+# and this results in the checksums being incorrect.
+
+# Iptables path, used for ipv4 firewall.
+IPTABLES=$(which iptables)
+if [ ! -z "${IPTABLES}" ]; then
+    if ! ${IPTABLES} -C POSTROUTING -t mangle -p tcp --sport 80 -j CHECKSUM --checksum-fill 2> /dev/null; then
+        ${IPTABLES} -A POSTROUTING -t mangle -p tcp --sport 80 -j CHECKSUM --checksum-fill
+    fi
+fi
+
+# Ip6tables path, used for ipv6 firewall.
+IP6TABLES=$(which ip6tables)
+if [ ! -z "${IP6TABLES}" ]; then
+    if ! ${IP6TABLES} -C POSTROUTING -t mangle -p udp --sport 80 -j CHECKSUM --checksum-fill 2> /dev/null; then
+        ${IP6TABLES} -A POSTROUTING -t mangle -p udp --sport 80 -j CHECKSUM --checksum-fill
+    fi
+fi
diff --git a/tasks/neutron_post_install.yml b/tasks/neutron_post_install.yml
index 35c86f4f..cfe9734a 100644
--- a/tasks/neutron_post_install.yml
+++ b/tasks/neutron_post_install.yml
@@ -156,3 +156,26 @@
   tags:
     - sudoers
     - neutron-sudoers
+
+- name: Drop metadata iptables checksum fix
+  copy:
+    src: "post-up-metadata-checksum"
+    dest: "/etc/network/if-up.d/post-up-metadata-checksum"
+    owner: "root"
+    group: "root"
+    mode: "0755"
+  when:
+    - neutron_metadata_checksum_fix | bool
+    - inventory_hostname in groups[neutron_services['neutron-linuxbridge-agent']['group']]
+  tags:
+    - neutron-config
+    - neutron-checksum-fix
+
+- name: Run metadata iptables checksum fix
+  command: /etc/network/if-up.d/post-up-metadata-checksum
+  when:
+    - neutron_metadata_checksum_fix | bool
+    - inventory_hostname in groups[neutron_services['neutron-linuxbridge-agent']['group']]
+  tags:
+    - neutron-config
+    - neutron-checksum-fix