[libvirt-users] double nat - common setup

hi everybody my mind must have gone blank & eyes blind, I'm hoping it's simple and somebody can shed the light on bit I cannot see. a regular default net: <network> <name>default</name> <uuid>4c0a0c44-7e8a-493b-a57c-87cd38eaa0f7</uuid> <forward mode='nat'/> <bridge name='virbr0' stp='on' delay='0'/> ... a winbox on that net and I cannot access it from/via Internet, port forwarding fixed on the default gw/internet interface (or rather firewalld's zone), it forwards to winbox. what is it?