I've been searching for a smart solution for a XenServer firewall for about a month now. The documentation for the new default networking backend "openvswitch" is not that detailed and I can barely find guides to filter packages with OVS. The other possibility would be linux bridge with iptables (which I am going to evaluate in the next couple days).
How are you firewalling with you XenServers? Do you use the Dom0 for it, do you have a dedicated VM for it ... ?