This currently doesn't work due to beta running on the labs network, which blocks the use of more interesting network routing used by LVS as a security feature.
I always assumed that was nova-network itself, but according to @chasemp: libvirt's native security group handling (that nova-network offloads to) prevents it.
However, when main labs runs on neutron instead of nova-network (neutron doesn't use libvirt's native handling of this stuff), we should be able to do http://superuser.openstack.org/articles/managing-port-level-security-openstack/ and open up the rules enough such that our backend hosts can impersonate the LVS host, and the LVS host can impersonate external traffic. (obviously haven't tested it but I believe those are the allowances that would need to be made).