Description of problem:

This command fails:

virsh net-start default

Version-Release number of selected component (if applicable):

firewalld-0.6.3-2.fc30.noarch

How reproducible:

virsh net-start default

Steps to Reproduce:
1. see above
2.
3.

Actual results:

KVM network does not start.

[root@bat zones]# virsh net-start default
error: Failed to start network default
error: internal error: Failed to apply firewall rules /usr/sbin/ip6tables --table filter --list-rules: ip6tables v1.8.0 (legacy): can't initialize ip6tables table `filter': Permission denied
Perhaps ip6tables or your kernel needs to be upgraded.


[root@bat zones]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2019-04-29 20:08:06 CEST; 14s ago
     Docs: man:firewalld(1)
 Main PID: 9282 (firewalld)
    Tasks: 2 (limit: 4915)
   Memory: 22.8M
   CGroup: /system.slice/firewalld.service
           └─9282 /usr/bin/python3 /usr/sbin/firewalld --nofork --nopid

Apr 29 20:08:06 bat.localdomain systemd[1]: Starting firewalld - dynamic firewall daemon...
Apr 29 20:08:06 bat.localdomain systemd[1]: Started firewalld - dynamic firewall daemon.
Apr 29 20:08:06 bat.localdomain firewalld[9282]: ERROR: Failed to load zone file '/usr/lib/firewalld/zones/libvirt.xml': PARSE_ERROR: rule: Unexpected attribute priority

This is the content of /usr/lib/firewalld/zones/libvirt.xml:

<?xml version="1.0" encoding="utf-8"?>
<zone target="ACCEPT">
  <short>libvirt</short>

  <description>
    The default policy of "ACCEPT" allows all packets to/from
    interfaces in the zone to be forwarded, while the (*low priority*)
    reject rule blocks any traffic destined for the host, except those
    services explicitly listed (that list can be modified as required
    by the local admin). This zone is intended to be used only by
    libvirt virtual networks - libvirt will add the bridge devices for
    all new virtual networks to this zone by default.
  </description>

<rule priority='32767'>
  <reject/>
</rule>
<protocol value='icmp'/>
<protocol value='ipv6-icmp'/>
<service name='dhcp'/>
<service name='dhcpv6'/>
<service name='dns'/>
<service name='ssh'/>
<service name='tftp'/>
</zone>


Expected results:

KVM network should start.

Additional info:

I am using Fedora 30 Silverblue.