On 03/22/2017 12:11 PM, Cole Robinson wrote: Yeah, it would be problematic for libvirt to try and automatically add rules to allow incoming connections to VNC ports with the current information it has available. It's likely that even if you did want to allow it, you might want it limited to only come from certain addresses, for example. There might be some reasonable way to do it by adding a "firewallZone" attribute that could integrate with firewalld's concept of zones, but that would require somebody stepping up to advocate for it and do the work :-) A more practical solution to your problem with the existing versions of tools may be to hardcode a port for the VNC listener (since you're already in there hardcoding an IP address), then add a rule to firewalld directly for that hardcoded port.