Why is port forwarding via libvirt hook hijacking external NAT traffic?

Question

I have an Ubuntu box acting as both a NAT gateway as well as hosting KVM virtual machines. I followed a guide to use the libvirt qemu hook to forward ports to one of the KVM VMs, but this seems to also be hijacking outgoing connections to those ports from any of the NAT'd boxes.

eno0 = 192.168.70.1 = Internal interface on NAT gateway

eno1 = 10.240.45.45 = External interface on NAT gateway

virbr0 = 192.168.122.1 = Bridge for KVM VMs

KVM Guest IP = 192.168.122.81

/etc/libvirt/hooks/qemu:

if [ "${1}" = "myvm" ]; then

   GUEST_IP=192.168.122.81

   if [ "${2}" = "stopped" ] || [ "${2}" = "reconnect" ]; then
        /sbin/iptables -D FORWARD -o virbr0 -d  $GUEST_IP -j ACCEPT
        /sbin/iptables -t nat -D PREROUTING -p tcp -d 10.240.45.45 --dport 443 -j DNAT --to $GUEST_IP:443
   fi
   if [ "${2}" = "start" ] || [ "${2}" = "reconnect" ]; then
        /sbin/iptables -I FORWARD -o virbr0 -d  $GUEST_IP -j ACCEPT
        /sbin/iptables -t nat -A PREROUTING -p tcp -d 10.240.45.45 --dport 443 -j DNAT --to $GUEST_IP:443
   fi
fi

This does correctly forward traffic from any external hosts pointing at 10.240.45.45. However, if I try to go to any HTTPS page (including https://google.com) from a system behind the NAT, it gets hijacked and redirected to the VM instead of going to the external host.

Why is it ignoring the -d parameter and how can I make this only forward traffic meant for 10.240.45.45?