On the machine serving as the firewall for a network, I've installed a VM to bridge to a remote VPN. Since then, I've noticed none of the devices connected to the said VPN had their connections filtered by the chain I applied to FORWARD, but did work for devices on the LAN. Only once I added the rule to jump to the chain if the input physical device is
virbr0 on OUTPUT did it apply to the VM and devices it bridged through the VPN.
Why are the traffic from VMs classified as OUTPUT traffic? Logically, shouldn't the kernel treat the traffic as originated from foreign devices?