You are probably affected by this change:
On the other hand, consider the following:
- Firewalld is the recommended firewall appliance.
- Docker and libvirt can integrate with Firewalld.
- iptables is on the way to deprecation.
Note that you can greatly simplify the setup by replacing macvtap/host-only with a shared host bridge:
If you continue using virtual networks, incoming traffic can be allowed like this:
Then use policies to forward traffic between zones:
sudo firewall-cmd --permanent --add-masquerade
sudo firewall-cmd --permanent --zone=libvirt --set-target=default
sudo firewall-cmd --permanent --zone=libvirt --remove-rich-rule="rule priority=32767 reject"
sudo firewall-cmd --permanent --new-policy=libvirt-any
sudo firewall-cmd --permanent --policy=libvirt-any --set-target=ACCEPT
sudo firewall-cmd --permanent --policy=libvirt-any --add-ingress-zone=libvirt
sudo firewall-cmd --permanent --policy=libvirt-any --add-egress-zone=ANY
sudo firewall-cmd --permanent --new-policy=docker-any
sudo firewall-cmd --permanent --policy=docker-any --set-target=ACCEPT
sudo firewall-cmd --permanent --policy=docker-any --add-ingress-zone=docker
sudo firewall-cmd --permanent --policy=docker-any --add-egress-zone=ANY
sudo firewall-cmd --reload