I'm trying to set up a port forward to a KVM guest, managed through Libvirt on Debian 6. The VM is running in NAT, through the "default" network. This all runs fine, the VM has full internet connection. However, the host cannot reach the vm internally. Neither ping, nc nor nmap on the NAT network give any signs of the VM. Due to this, the normal iptables forwarding rules don't work either.

$ cat /etc/debian_version

6.0.5

$ libvirtd --version

libvirtd (libvirt) 0.9.11.3

$ kvm --version

QEMU emulator version 1.0 (qemu-kvm-1.0+dfsg-11, Debian), Copyright (c) 2003-2008 Fabrice Bellard

ifconfig:

eth0      Link encap:Ethernet  HWaddr 54:04:a6:f1:6f:10  
          inet addr:x.x.x.x  Bcast:x.x.x.x  Mask:255.255.255.x
          inet6 addr: fe80::5604:a6ff:fef1:6f10/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:118902 errors:0 dropped:0 overruns:0 frame:0
          TX packets:142357 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:13247173 (12.6 MiB)  TX bytes:95163190 (90.7 MiB)
          Interrupt:28 Base address:0xe000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:230646 errors:0 dropped:0 overruns:0 frame:0
          TX packets:230646 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:204577107 (195.0 MiB)  TX bytes:204577107 (195.0 MiB)

virbr0    Link encap:Ethernet  HWaddr fe:54:00:e2:d2:60  
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5050 errors:0 dropped:0 overruns:0 frame:0
          TX packets:961 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:666759 (651.1 KiB)  TX bytes:400701 (391.3 KiB)

vnet0     Link encap:Ethernet  HWaddr fe:54:00:e2:d2:60  
          inet6 addr: fe80::fc54:ff:fee2:d260/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5050 errors:0 dropped:0 overruns:0 frame:0
          TX packets:125687 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:739803 (722.4 KiB)  TX bytes:6886609 (6.5 MiB)