On the machine serving as the firewall for a network, I've installed a VM to bridge to a remote VPN. Since then, I've noticed none of the devices connected to the said VPN had their connections filtered by the chain I applied to FORWARD, but did work for devices on the LAN. Only once I added the rule to jump to the chain if the input physical device is virbr0 on OUTPUT did it apply to the VM and devices it bridged through the VPN.

Why are the traffic from VMs classified as OUTPUT traffic? Logically, shouldn't the kernel treat the traffic as originated from foreign devices?


You've created a bridge consisting of the host's interface and the VM's interface. So traffic leaving the VM is essentially just being sent out from the bridge over the host's interface, and hence is OUTPUT traffic.It's not being received by the host on any interface, it just "appears" on the bridge.

You may want to investigate ebtables which is like iptables but for use on bridges.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.