Comment 4 for bug 1103870

Doug, the default does in fact let you have inbound connections. All you would have to do is add some iptables rules that take care of it.

The default is nothing more than a linux bridge with dnsmasq and iptables, configured by libvirt. you can use brutil, iptables and dnsmasq config to change it's configuration (which will be overriden on next boot) or you use virsh to control all aspects of it (which will then be persistant across boots). now that I have learnt more in the meantime since opening thi "bug", I tend to just destroy the default bridge and set up new ones from scratch.

that default thingy is no magic. it's all standard. and hence there should be more documentation about it. although ofcourse we could all argue since this is libvirt/kvm defaults, one could look up the documentation for that.