[strongSwan] sever's local bridge iface

[lejeczek]

hi everyone

I have a working strongswan and from clients I can get to 
swan's local iface, whichis of bridge type, but..

clients => ext iface(swan), internal iface(bridge) <=> a 
virtual machine

...that virtual machine which sits on/behind that bridge 
interface, I cannot get to from clients. I can only ping VM 
fromclients.
VM has not firewall and itself can communicate with outside.
Firewall on swan server should not matter right? Since 
clients can get to swan internal IP(and different services 
there) and because it's a bridge it cannot be bother by 
iptables as it's lower level, right?

What is it I'm missing?
many thanks, L.