diff --git a/libvirt.spec.in b/libvirt.spec.in
index 0e8dc000f3..fce312c8ab 100644
--- a/libvirt.spec.in
+++ b/libvirt.spec.in
@@ -356,8 +356,6 @@ BuildRequires: sanlock-devel >= 2.4
 BuildRequires: libpcap-devel >= 1.5.0
 BuildRequires: libnl3-devel
 BuildRequires: libselinux-devel
-BuildRequires: iptables
-BuildRequires: ebtables
 # For modprobe
 BuildRequires: kmod
 BuildRequires: cyrus-sasl-devel
diff --git a/meson.build b/meson.build
index af3719a734..91211d7964 100644
--- a/meson.build
+++ b/meson.build
@@ -838,10 +838,7 @@ optional_test_programs = [
 
 optional_programs = [
   'dmidecode',
-  'ebtables',
   'ip',
-  'ip6tables',
-  'iptables',
   'iscsiadm',
   'mdevctl',
   'mm-ctl',
diff --git a/src/network/bridge_driver_conf.c b/src/network/bridge_driver_conf.c
index f63a978096..c619a0a09c 100644
--- a/src/network/bridge_driver_conf.c
+++ b/src/network/bridge_driver_conf.c
@@ -27,8 +27,10 @@
 #include "virerror.h"
 #include "virfile.h"
 #include "virutil.h"
+#include "virfirewall.h" /* for binary names */
 #include "bridge_driver_conf.h"
 
+
 #define VIR_FROM_THIS VIR_FROM_NETWORK
 
 VIR_LOG_INIT("network.bridge_driver");
diff --git a/src/util/virfirewall.h b/src/util/virfirewall.h
index 917745c315..4ac16f02b3 100644
--- a/src/util/virfirewall.h
+++ b/src/util/virfirewall.h
@@ -25,6 +25,11 @@
 #include "virbuffer.h"
 #include "virxml.h"
 
+/* various external programs executed when applying firewalls */
+#define EBTABLES "ebtables"
+#define IPTABLES "iptables"
+#define IP6TABLES "ip6tables"
+
 typedef struct _virFirewall virFirewall;
 
 typedef struct _virFirewallCmd virFirewallCmd;