diff --git a/src/nwfilter/nwfilter_dhcpsnoop.c b/src/nwfilter/nwfilter_dhcpsnoop.c
index 0965f6301d..3e9f046589 100644
--- a/src/nwfilter/nwfilter_dhcpsnoop.c
+++ b/src/nwfilter/nwfilter_dhcpsnoop.c
@@ -74,8 +74,9 @@
 
 #ifdef HAVE_LIBPCAP
 
-# define LEASEFILE LOCALSTATEDIR "/run/libvirt/network/nwfilter.leases"
-# define TMPLEASEFILE LOCALSTATEDIR "/run/libvirt/network/nwfilter.ltmp"
+# define LEASEFILE_DIR LOCALSTATEDIR "/run/libvirt/network/"
+# define LEASEFILE LEASEFILE_DIR "nwfilter.leases"
+# define TMPLEASEFILE LEASEFILE_DIR "nwfilter.ltmp"
 
 struct virNWFilterSnoopState {
     /* lease file */
@@ -1881,6 +1882,11 @@ virNWFilterSnoopLeaseFileRefresh(void)
 {
     int tfd;
 
+    if (virFileMakePathWithMode(LEASEFILE_DIR, 0700) < 0) {
+        virReportError(errno, _("mkdir(\"%s\")"), LEASEFILE_DIR);
+        return;
+    }
+
     if (unlink(TMPLEASEFILE) < 0 && errno != ENOENT)
         virReportSystemError(errno, _("unlink(\"%s\")"), TMPLEASEFILE);