Comment # 9 on bug 1226105 from James Fehlig

(In reply to Alexander Graul from comment #7)
> i | iptables-backend-nft | Metapackage to make nft the default backend for
> iptables/arptables/ebtables | package

iptables-backend-nft creates two top level nftable tables that are shared by
all applications using iptables. You can see them in your 'nft list ruleset ip'
output, with a warning not to touch :-).

With libvirt's switch to using nftables directly, it now creates its own top
level table. And recall in nftables, for a packet to get through it must be
allowed by all top level tables. Notice in your output the 'ip filter' table
has

type filter hook forward priority filter; policy drop;

This github issue comment has more details

https://gitlab.com/libvirt/libvirt/-/issues/644#note_1940628451

The issue also describes why it works prior to the switch to using nftables
directly, and a workaround. E.g. in /etc/libvirt/network.conf, set

firewall_backend = "iptables"

and restart virtnetworkd (or libvirtd if you're using monolithic daemon). Does
this work for you?

FYI, this post has a nice description of relationship between iptables,
iptables-nft, and nftables

https://developers.redhat.com/blog/2020/08/18/iptables-the-two-variants-and-their-relationship-with-nftables#