The problems I run into and their solutions

VM Has an IP But No Internet: The Culprit Is Docker

My virtual machine picked up an IP address over DHCP and could reach the host, but it could not reach the internet. Network settings, driver, NAT mode; everything was correct. The cause turned out to be a Docker firewall rule. Anyone running KVM/libvirt and virt-manager on the same machine can hit this. I tried the fix everyone recommends online — restarting the virtual network — and it did nothing. The packet counters gave the real answer: Docker's policy drop in the FORWARD chain was discarding my VM's packets before they ever reached NAT. Here is the diagnosis step by step, and a permanent fix with a systemd service.