Hello,
We just activate firewall on a Proxmox 4.4 installation.
We observed that proxmox automatically add a masquerade rule :
# iptables-save |grep MASQ
-A POSTROUTING -o vmbr0 -j MASQUERADE
So we need to delete this rule at every reboot or the VMs are seeing connections from the hypervisor...