One thing that annoyed me very much about libvirt is that it will change your iptables configuration as soon as you start a routed/natted network.

I patched my libvirt so that I can disable that. For me the default behavior is a no go because I need to control my firewall settings in one place.