[libvirt-users] Isolate VMs' network

All, I'm trying to setup a network with some virtual machines, that can connect to each other and to the internet, but neither to the host nor to other VMs. Is there any preconfigured network filter or best-practice for this setup? Of course, I could setup iptables rules on the host, but I'd prefer libvirt to handle them. - Chris