diff --git a/src/nwfilter/nwfilter_driver.c b/src/nwfilter/nwfilter_driver.c
index 8e3db439598f3469a6ec354d0bf479037223612e..1a868b6c01d41392d367f07e1e7e2f0beacba2eb 100644
--- a/src/nwfilter/nwfilter_driver.c
+++ b/src/nwfilter/nwfilter_driver.c
@@ -176,9 +176,6 @@ nwfilterStateInitialize(bool privileged,
     char *base = NULL;
     DBusConnection *sysbus = NULL;
 
-    if (!privileged)
-        return 0;
-
     if (virDBusHasSystemBus() &&
         !(sysbus = virDBusGetSystemBus()))
         return -1;
@@ -193,6 +190,9 @@ nwfilterStateInitialize(bool privileged,
     driver->watchingFirewallD = (sysbus != NULL);
     driver->privileged = privileged;
 
+    if (!privileged)
+        return 0;
+
     nwfilterDriverLock();
 
     if (virNWFilterIPAddrMapInit() < 0)
@@ -535,6 +535,12 @@ nwfilterDefineXML(virConnectPtr conn,
     virNWFilterObjPtr nwfilter = NULL;
     virNWFilterPtr ret = NULL;
 
+    if (!driver->privileged) {
+        virReportError(VIR_ERR_OPERATION_INVALID, "%s",
+                       _("Can't define NWFilters in session mode"));
+        return NULL;
+    }
+
     nwfilterDriverLock();
     virNWFilterWriteLockFilterUpdates();
     virNWFilterCallbackDriversLock();