Recently I had an issue with my KVM server Linux bridge as a result of Netfilter blocking all traffic to the VMs and traffic out of the VMs. I could only reach the VMs from the hypervisor. On further troubleshooting, I noticed the issue was on Netfilter filtering traffic. The solution around this was to prevent bridged traffic from getting pushed through the host’s iptables rules.

What’s netfilter and iptables?

Netfilter is a framework provided by Linux that allows various networking-related operations to be implemented in the form of customized handlers. Iptables is a widely used firewall tool that interfaces with the kernel’s netfilter packet filtering framework.

disbale bridge filtering kvm 1

The iptables firewall works by interacting with the packet filtering hooks in the Linux kernel’s networking stack. These kernel hooks are known as the netfilter framework.

Disable netfilter on a KVM bridge

In order to prevent bridged traffic from getting pushed through the host’s iptables rules, you need to set kernel settings in the /proc/sys/ directory. This can be a run-time change or persistent.

For a quick overview of all settings configurable in the /proc/sys/ directory, type the command:

sudo sysctl -a

The sysctl command can be used in place of echo to assign values to writable files in the /proc/sys/ directory. So let’s disable netfilter on KVM bridge, for runtime change, run:

echo 0 | sudo tee /proc/sys/net/bridge/bridge-nf-call-arptables
echo 0 | sudo tee /proc/sys/net/bridge/bridge-nf-call-iptables
echo 0 | sudo tee /proc/sys/net/bridge/bridge-nf-call-ip6tables

Note that these special settings within /proc/sys/ are lost when the machine is rebooted. To preserve custom settings, add them to the /etc/sysctl.conf file.

sudo tee -a /etc/sysctl.conf <<EOF
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0


sudo sysctl -p /etc/sysctl.conf

Each time the system boots, the init program runs the /etc/rc.d/rc.sysinit script which contains a command to execute sysctl using /etc/sysctl.conf to determine the values passed to the kernel.

With this set, you’re good to go. Test your bridge connectivity if it’s working fine now.

Check more guides on KVM:

How To Create CentOS 8 KVM Image Template on OpenStack

How to extend/increase KVM Virtual Machine (VM) disk size

How to Create CentOS / Fedora / RHEL VM Templates on KVM

How to Provision VMs on KVM with Terraform

Your support is our everlasting motivation,
that cup of coffee is what keeps us going!

As we continue to grow, we would wish to reach and impact more people who visit and take advantage of the guides we have on our blog. This is a big task for us and we are so far extremely grateful for the kind people who have shown amazing support for our work over the time we have been online.

Thank You for your support as we work to give you the best of guides and articles. Click below to buy us a coffee.


  1. Thank you for this post! Saved me some hours to fix a home-assistant vm running in virt-manager (kvm) on a Ubuntu host. First ‘solution’ was to remove the br_netfilter module, but that is re-activated on reboot. This solution feels far more solid.


Please enter your comment!
Please enter your name here