(In reply to Santiago Zarate from comment #2) > iptables-backend-nft should help here. I remember thinking about that while doing the investigation for comment #1. But now that I've looked closer, I'm not sure how it will help. libvirt currently 'BuildRequires' iptables, and the libvirt-daemon-driver-{network,nwfilter} subpackages 'Requires' iptables. I can substitute that for iptables-backend-nft, but I see iptables-backend-nft itself 'Requires' iptables. Or it's quite possible I'm missing how you envision iptables-backend-nft will help :-).