> It's also possible that user use vmbr0 (with eth0 plugged) in nat mode or > routed mode. > (maybe this need some dhcp iptables filtering too) vmbr0 is connected to a physical interface, so that is IMHO impossible. Please can you clearly define what routed mode is (still not understand)?