After several tests, I can confirm that adding the bridge filters below solve the IP/MAC filtering and security group problem (not working) with CentOS 7.2. The filters are disabled by defaut in /usr/lib/sysctl.d/00-system.conf. Also, the br_netfilter kernel module doesn’t exists in CentOS 7. The right module name is bridge and it is loaded automatically when the 802.1Q bridge interface is created by OpenNebula.
My problem with VM that can’t join the outisde was solved by rebooting the host (i don’t understand why).
Thanks again Jaime.