libvirt with qemu guest, bridged networking does not work

I am trying to get a VM operational and working so my router can forward a high port to its SSH, allowing someone on the Internet to connect to the VM. I am familiar with how to make that part of it operational.

I first tried bridged networking. With that, the guest does not get an IP address. If I set an IP address on the guest manually, then the guest can ping Internet addresses, but TCP connections do not work. That is very weird.

If I set it to NAT networking instead, then it gets an IP address and networking works, but I am then unable to get qemu port forwarding to work. Interesting side note: NAT used to assign an IP address to the guest from the virbr0 network range on the containing host (192.168.122.0/24), now it assigns an address from an entirely different network (10.0.2.0/24) which I do not see anywhere on the libvirt host. But I can make successful outbound gonnections from the VM, so it's a curiosity, not a real problem.

I would prefer bridged networking, but if I can get port forwarding working with NAT, that is an acceptable solution.

The libvirt host is Ubuntu Server 22.0.4 and has NIC eno1 included in br0, with the IP address on br0. When I set the guest to bridged networking, I connect it to br0. The bridge on that host seems to work perfectly outside of libvirt. It is running libvirt version 8.0.0-1ubuntu7.2 and qemu version 1:6.2+dfsg-2ubuntu6.4.

The guest is Ubuntu Server 20.04.

EDIT: bridges layouts added from comment:

elyograg@smeagol:~$ brctl show
bridge name     bridge id           STP enabled     interfaces
br0             8000.168b32b94b55   yes             eno1
                                                    eno2
                                                    vnet0 
docker0         8000.0242aa9c3cdf   no              
virbr0          8000.525400728c3a   yes             

This was fixed by adding this line to the sysctl config and using sysctl -w to change it imemediately:

net.bridge.bridge-nf-call-iptables = 0

But then I discovered that using a bridged network was breaking ucarp, which I need. So I got rid of br0, and figured out how to use a libvirt hook to forward a host port to port 22 on the VM in NAT mode, which was the whole reason I wanted the VM to use bridged networking -- making it accessible outside the libvirt host.

Now I am using a team0 interface, which didn't immediately work with ucarp either. Adding ifup team0:ucarp to /etc/rc.local fixed that. When things are calm, I will try br0 again and using ifup br0:ucarp instead.