Internet forwarding to hostonly kvm network?

Question

linux

I'm just getting into Linux.
There is a server with Debian 10. Virtual machines with debian and win8 are launched on it via libvrt.
The host system has a physical network card enp3s0, which looks at the router, receives the Internet from it and distributes host resources to the local network and ... the virbr0 network bridge, which is isolated and communicates only with these two virtual machines.
How can I distribute the Internet from the host to these 2 virtual machines (in fact, to the virbr0 network bridge) and forward ports ... well, for example 22 and 80 (so that in the future I can give access to them through a router to a person from an already external network)?

IMPORTANT. Do not give these two virtual machines access to the local network (in general, neither to computers, nor to the router, nor to the host).

Please help and don't make fun of my lamerism)

Answer 1

Set up the bridge and guests as regular router clients. It is possible DHCP, it is possible a statics, it is possible mac+ip.
It should work.

IMPORTANT. Do not give these two virtual machines access to the local network (in general, neither to computers, nor to the router, nor to the host).

iptables on host