RE: How can I create a VM in virt-manager that can access the internet through the host but can't even see the host or other devices on the LAN?

[Marc]

I think such a thing can be done with macvtap. Check about using different 
vlans and test macvtap modes that prevent communicating with the host.

> 
> I don't have a router that I can create custom rules to block things. I
> was hoping there would be a way to do this entirely on the host but it
> doesn't look like it is possible.