On 10/02/2018 09:53 AM, Cole Robinson wrote: If you want a network that doesn't even allow connections between the host and the guests, then you won't want DNS or DHCP running on the host for that network either, and for that matter, you will want the host to not have any IP address for that network. (Of course in this case the guests on the network will need to have their IP addresses statically configured, or you'll need to run your own dhcp server on one of the guests). If that is what you want, then you want a network declared like this: <network> <name>reallyisolated</name> </network> This will setup a bridge that has no IP address on the host, no DHCP server, and no DNS server, but the guests will still be able to communicate among themselves. If you want the host to handle dhcp requests from the guests, but not allow any traffic, then you can add in an IP address with a <dhcp> section, but configure the firewall of the host to reject all traffic on the bridge interface other than dhcp; guests will still be able to communicate with each other.