> I'd be interested in exploring how you would prefer the network topology to look like.

I tried to highly restrict my virtual machine with just an allow list (works via firewalld), and at the same time allowing the vm to query the (physical) LAN for dns-sd.

Tbh, I could not get the latter to work directly. I ended up letting my host function as an dns-sd reflector.

> virtual bridge

Does that work with wlan? libvirt creates a bridge, but with or without NAT it could not let the vm participate like a normal LAN-client. I thought it was a limitation of wireless lan bridging.