The firewall section has been renamed in upstream ironic inspector:

https://github.com/openstack/ironic-inspector/commit/7b2758546376394777c7d36c8f5bb62ff7ef3830

Consequently the iptables pxe filter does not work if the actual
dnsmasq interface name differs from the default (br-ctlplane), as can
be seen from this snippet of iptables-save output:

-A INPUT -i br-ctlplane -p udp -m udp --dport 67 -j ironic-inspector

Change-Id: Ic1d08b85e0b5992fbee489f2f9fd174982b5d493