I have setup a KVM host using a routed bridge (interface br0) where the virtual machines are connected. I can reach services inside the VMs on the bridge from the KVM host without problems. I can reach services on the bridged VMs from the internet (public zone) due to

firewall-cmd --permanent --direct --passthrough ipv4 -I FORWARD -m physdev --physdev-is-bridged -j ACCEPT

I have added OpenVPN server to the KVM host (using tun0) and want to reach services on the bridged VMs from an OpenVPN client. This works if firewallD is shutdown but not with firewallD.

I tried adding tun0 to the internal zone and br0 to the dmz and enable https service (e.g.) on both, but no difference. HTTPS is only reachable from the public zone (internet).

I also tried various additional direct passthrough commands but to no avail. I guess there is something basic I overlook, but since I overlook it ...

1 Answer 1


I'm on the exact same situation here. I have a bridged setup KVM with firewalld and I can connect to the OpenVPN just fine but can't reach the "guest" network. Not sure what else to do to allow traffic.

EDIT: OK, I managed to do it. You need to add the following rules (depending on your adapters name):

# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i tun0 -o virbr0 -j ACCEPT
# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i virbr0 -o tun0 -j ACCEPT

That did the trick. Hope it is helpful! :-)

PS: For some reason I cannot make it "--permanent" as once it's reloaded it breaks the connection. If someone knows why, it'd be great but I can live with that .

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .