All, I'm using 4.4.0-89-generic #112-Ubuntu Kernel. I've setup a bridge bridge name bridge id STP enabled interfaces br0 8000.00322e111b2 no enp3s0 vnet0 Why is it possible to DROP packages from a KVM guest on the host INPUT chain, but not to LOG them? I've not loaded any bridge-nf modules. bridge/nf_call_iptables is 0. - Chris