Solution 1:

The example script on the libvirt wiki seems to be missing "-p" in the FORWARD lines, the proper way to issue it is:

sudo iptables -I FORWARD -o virbr0 -d  192.168.122.99 -p tcp --dport 22 -j ACCEPT
sudo iptables -t nat -I PREROUTING -p tcp --dport 22221 -j DNAT --to 192.168.122.99:22