Couple of things to try
- At the VM level, ping your own address on eth1 to see if local traffic works.
- Using your existing port config, capture traffic at the VM level to see if the packets are reaching the VM.
- Disable port-security on the port level and validate if the traffic is reaching the VM.
- If you have access to the compute, capture traffic at the interface/tap/bridge level. Where to capture will depend on if you are using OVS/OVN/Linux-bridge.
- I do believe that even with allowed-address on the port, you will need to have the corresponding traffic allowed in your sec-group.
Can you paste the port info with "openstack port show $port_id_here"?