先放结论

根据libvirt关于防火墙的说明：

If firewalld is active on the host, libvirt will attempt to place the bridge interface of a libvirt virtual network into the firewalld zone named **“libvirt” ** (thus making all guest->host traffic on that network subject to the rules of the “libvirt” zone).

我需要在firewalld (I am using a Fedora host)的libvirt区域中添加对应的放行规则: