Just remembered a few details that may help diagnose the firewall case: - System has two network cards. - Only eth0 is connected, eth1 doesn't have a cable connected. - Install included kvm support, so bridges br0 and br1 where auto created. - After install, the firewall hadn't the external interface specified and some yast utilities (DNS server, ...) when instructed to open ports wanted to open ports in all 4 interfaces (brX, ethX) until I manually specified that br0 is the external interface. Just in case this clarifies things.