Forwarding traffic to specific IP to a KVM guest

Question

I have a Debian 7 server with 5 public IP addresses. On the server I have several KVM guests (all Debian 8). One of the guests needs to be publicly accessible using one of the public IPs. This one has IP address 192.168.122.133 and all other guests have IPs in the range 192.168.122.50/28.

I currently have it set up so that the guests can communicate with each other, however external incoming and outgoing connections fail with the guest that needs to be publicly accessible (only connections from local network work).

These are the rules that I believe are supposed to forward all incoming and outgoing traffic to and from it this guest, but it doesn't seem to be doing what it should:

/sbin/iptables -t nat -I PREROUTING -d 111.111.111.133 -j DNAT --to 192.168.122.133
/sbin/iptables -t nat -I POSTROUTING -s 192.168.122.133 -j SNAT --to 111.111.111.133
/sbin/iptables -t filter -I FORWARD -d 192.168.122.133 -j ACCEPT
/sbin/iptables -t filter -I FORWARD -s 192.168.122.133 -j ACCEPT

Previously I had this set up and I believe at one point in time it was working correctly, but I might have changed something or some sort of system update might have changed something and now it's not working.

More info:

The KVM network is configured:

<network>
  <name>default</name>
  <uuid>261764e8-ef0c-dc57-90b5-4c356ae12bf1</uuid>
  <forward mode='nat'/>
  <bridge name='virbr0' stp='on' delay='0' />
  <mac address='52:54:00:77:D9:2B'/>
  <ip address='192.168.122.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.122.2' end='192.168.122.254' />
    </dhcp>
  </ip>
</network>

And the guest network configurations are like this:

<interface type='network'>
  <mac address='52:54:00:61:d9:ba'/>
  <source network='default'/>
  <model type='virtio'/>
  <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>

Here is my /etc/network/interfaces on the host server:

# The loopback network interface
auto lo

auto eth3
auto eth3:0
auto eth3:1
auto eth3:2
auto eth3:3

iface lo inet loopback

# The primary network interface
allow-hotplug eth3
iface eth3 inet static
        address 111.111.111.130
        netmask 255.255.255.248
        network 111.111.111.128
        broadcast 111.111.111.135
        gateway 111.111.111.129
        dns-nameservers 8.8.8.8 8.8.4.4 127.0.0.1

iface eth3:0 inet static
    address 111.111.111.131
    netmask 255.255.255.248

iface eth3:1 inet static
    address 111.111.111.132
    netmask 255.255.255.248

iface eth3:2 inet static
    address 111.111.111.133
    netmask 255.255.255.248

iface eth3:3 inet static
    address 111.111.111.134
    netmask 255.255.255.248

The guests are set up with static IPs. For example:

iface eth0 inet static
    address 192.168.122.133
    netmask 255.255.255.0
    network 192.168.122.0
    broadcast 192.168.122.255
    gateway 192.168.122.1
    dns-nameservers 192.168.122.1

I believe this is what allows the guests that should not be accessible from the Internet to access the Internet (adapted from here) - note, they are in a slightly different IP range:

/sbin/iptables -t nat -A POSTROUTING -s 192.168.122.50/28 ! -d 192.168.122.50/28 -p tcp -j MASQUERADE --to-ports 1024-65535
/sbin/iptables -t nat -A POSTROUTING -s 192.168.122.50/28 ! -d 192.168.122.50/28 -p udp -j MASQUERADE --to-ports 1024-65535
/sbin/iptables -t nat -A POSTROUTING -s 192.168.122.50/28 ! -d 192.168.122.50/28 -j MASQUERADE
/sbin/iptables -t filter -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -t filter -A FORWARD -s 192.168.122.50/28 -i virbr0 -j ACCEPT
/sbin/iptables -t filter -A INPUT -s 192.168.122.50/28 -i virbr0 -j ACCEPT

Answer 1

The solution was to add a bridge interface in /etc/networking/interfaces, which had somehow become commented out. I appended the following:

auto br0 
iface br0 inet static
    address 111.111.111.133
    netmask 255.255.255.248
    bridge_ports eth3
    bridge_stp on
    bridge_fd 0
    bridge_maxwait 0

And then ran ifup br0 to bring the interface up.