diff --git a/nova/tests/unit/virt/libvirt/test_firewall.py b/nova/tests/unit/virt/libvirt/test_firewall.py
index d083af99685f..12954d8bf0c2 100644
--- a/nova/tests/unit/virt/libvirt/test_firewall.py
+++ b/nova/tests/unit/virt/libvirt/test_firewall.py
@@ -227,7 +227,9 @@ class IptablesFirewallTestCase(test.NoDBTestCase):
         mock_instlist.side_effect = _fake_instlist
 
         def fake_iptables_execute(*cmd, **kwargs):
-            process_input = kwargs.get('process_input', None)
+            process_input = kwargs.get('process_input')
+            if process_input is not None and isinstance(process_input, bytes):
+                process_input = process_input.decode('utf-8')
             if cmd == ('ip6tables-save', '-c'):
                 return '\n'.join(self.in6_filter_rules), None
             if cmd == ('iptables-save', '-c'):
@@ -279,12 +281,14 @@ class IptablesFirewallTestCase(test.NoDBTestCase):
 
         regex = re.compile('\[0\:0\] -A .* -j ACCEPT -p icmp '
                            '-s 192.168.11.0/24')
-        self.assertGreater(len(filter(regex.match, self.out_rules)), 0,
+        match_rules = [rule for rule in self.out_rules if regex.match(rule)]
+        self.assertGreater(len(match_rules), 0,
                            "ICMP acceptance rule wasn't added")
 
         regex = re.compile('\[0\:0\] -A .* -j ACCEPT -p icmp -m icmp '
                            '--icmp-type 8 -s 192.168.11.0/24')
-        self.assertGreater(len(filter(regex.match, self.out_rules)), 0,
+        match_rules = [rule for rule in self.out_rules if regex.match(rule)]
+        self.assertGreater(len(match_rules), 0,
                            "ICMP Echo Request acceptance rule wasn't added")
 
         for ip in network_model.fixed_ips():
@@ -292,17 +296,22 @@ class IptablesFirewallTestCase(test.NoDBTestCase):
                 continue
             regex = re.compile('\[0\:0\] -A .* -j ACCEPT -p tcp -m multiport '
                                '--dports 80:81 -s %s' % ip['address'])
-            self.assertGreater(len(filter(regex.match, self.out_rules)), 0,
+            match_rules = [rule for rule in self.out_rules
+                           if regex.match(rule)]
+            self.assertGreater(len(match_rules), 0,
                                "TCP port 80/81 acceptance rule wasn't added")
             regex = re.compile('\[0\:0\] -A .* -j ACCEPT -s '
                                '%s' % ip['address'])
-            self.assertGreater(len(filter(regex.match, self.out_rules)), 0,
+            match_rules = [rule for rule in self.out_rules
+                           if regex.match(rule)]
+            self.assertGreater(len(match_rules), 0,
                                "Protocol/port-less acceptance rule"
                                " wasn't added")
 
         regex = re.compile('\[0\:0\] -A .* -j ACCEPT -p tcp '
                            '-m multiport --dports 80:81 -s 192.168.10.0/24')
-        self.assertGreater(len(filter(regex.match, self.out_rules)), 0,
+        match_rules = [rule for rule in self.out_rules if regex.match(rule)]
+        self.assertGreater(len(match_rules), 0,
                            "TCP port 80/81 acceptance rule wasn't added")
 
     def test_filters_for_instance_with_ip_v6(self):
diff --git a/tests-py3.txt b/tests-py3.txt
index ab647bf059a4..7d169309d3f4 100644
--- a/tests-py3.txt
+++ b/tests-py3.txt
@@ -1,6 +1,5 @@
 nova.tests.unit.api.openstack.compute.test_user_data.ServersControllerCreateTest
 nova.tests.unit.test_wsgi.TestWSGIServerWithSSL
-nova.tests.unit.virt.libvirt.test_firewall.IptablesFirewallTestCase
 nova.tests.unit.virt.libvirt.test_vif.LibvirtVifTestCase
 nova.tests.unit.virt.xenapi.test_vm_utils.ResizeFunctionTestCase
 nova.tests.unit.virt.xenapi.test_vm_utils.ScanSrTestCase