+ } elsif ($target->{type} eq 'nfvm') {
+
+ $chain = 'PVEFW-FORWARD';
+ $pkg->{iface_in} = $route_state;
+ $pkg->{iface_out} = $nfvm_bridge;
+ # conditionally set physdev_out (same behavior as kernel)
+ if ($route_state eq $nfvm_bridge) {
+ $pkg->{physdev_out} = $nfvm_iface || die 'internal error';
+ }
+ $next_route_state = $nfvm_iface;
+