How do I set up an easy QEMU virtual machine network that I can quickly filter with iptables but not use a bridge or tap interface etc?
Ok ok, run qemu from a systemd-nspawn container WITH user isolation (-U flag). All container processes then will be of format: "vu-containername-number", including qemu. You can then create iptables filters for this virtual user containerized qemu process and all your traffic to/from container will be taken care of (iptables ... -m owner --uid-owner vu-blah-blah ... -j). Zero need for any network setups and added security from containerization.