I would like the VM (vnet0) to use br0 as a gateway which local connectivity wise seems fine but the internet is a bit odd. I can ping for example 1.1.1.1 dns without any issues but anying udp/tcp is a no go. 

I checked the physical hosts interface(eno2) and br0 to find that the VM's packets were successfully heading to br0 but when leaving the physical host(eno2) the tcp/udp packets weren't being masqueraded. The rule is pretty straightforward and to test I plugged another device into the eno1 afxdp port and had no connectivity issues and packets were being masqueraded fine.

I tried to set trustGuestRxFilters='yes' but that didn't work and the same state remained, the only thing that worked was using the "rtl8139" model type.

I always remember using 'virtio' in the past and I must be missing something crucial in the somewhat lengthy libvirt documentation.

Would be super helpful if someone can shed some light on this ? and possibly if I should be using virtio or the realtek driver ? 

Thanks ! (config below)

Iptables:

sudo iptables -t nat -A POSTROUTING -o eno2 -j MASQUERADE

ec13c3e2-6159-4019-984e-36cc90c59075

    Bridge br0

        fail_mode: standalone

        datapath_type: netdev

        Port vnet0

            Interface vnet0

        Port eno1

            Interface eno1

                type: afxdp

        Port br0

            Interface br0