diff --git a/devstack/lib/magnum b/devstack/lib/magnum
index 1e287a1b03..21361484b6 100644
--- a/devstack/lib/magnum
+++ b/devstack/lib/magnum
@@ -281,6 +281,8 @@ function configure_iptables {
         ROUTE_TO_INTERNET=$(ip route get 8.8.8.8)
         OBOUND_DEV=$(echo ${ROUTE_TO_INTERNET#*dev} | awk '{print $1}')
         sudo iptables -t nat -A POSTROUTING -o $OBOUND_DEV -j MASQUERADE
+        # bay nodes will access m-api (port $MAGNUM_SERVICE_PORT) to get CA certificate.
+        sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $MAGNUM_SERVICE_PORT -j ACCEPT || true
     fi
 }
 
diff --git a/magnum/tests/contrib/post_test_hook.sh b/magnum/tests/contrib/post_test_hook.sh
index 037b7a4198..a84dff9c83 100755
--- a/magnum/tests/contrib/post_test_hook.sh
+++ b/magnum/tests/contrib/post_test_hook.sh
@@ -99,16 +99,6 @@ nova keypair-add default
 echo_summary "Create a flavor"
 nova flavor-create  m1.magnum 100 2048 8 1
 
-# FIXME(eliqao): workaround for allow 9511 can be accessed from VM.
-# k8s nodes will access m-api (port 9511) to get CA certificate.
-sudo iptables -D openstack-INPUT -j REJECT --reject-with icmp-host-prohibited
-sudo iptables -D openstack-INPUT -m limit --limit 2/min -j LOG --log-prefix "iptables dropped: "
-
-sudo iptables -A openstack-INPUT -s 172.24.4.0/23 -p tcp -m tcp --dport 9511 -j ACCEPT
-sudo iptables -A openstack-INPUT -m limit --limit 2/min -j LOG --log-prefix "iptables dropped: "
-sudo iptables -A openstack-INPUT -j REJECT --reject-with icmp-host-prohibited
-
-
 # Run functional tests
 # Currently we support functional-api, functional-k8s, will support swarm,
 # mesos later.