How do I prevent libvirt from adding iptables rules for guest NAT networks?

Well I've found an answer that suits me: I've gone back to school and learned to do it the old fashioned way. No need to use libvirt's fancy networking functions as I can just:

  • set up my own bridged network(s) (not attached to any physical network port)
  • use a DHCP server on the host and masquerade in iptables
  • edit the libvirt guest config files to use the bridge(s)
  • have complete flexibility in how I want to configure security with iptables