I'm not sure as it relates specifically to XEN - but I would have a look through the /etc/rc.d directory. If it's not being turned on there, 'egrep -i iptables' /etc/init.d/* and see if it's in any startup script there. Slim chance they may be something in rc.local as well.
-Peter
Peter, Arghh, system-config-securitylevel had "security" enabled. So what does that do to start iptables? That was a lot of wasted time :)
jlc