KVM bridged networking not working with public ip addresses.

SUSE Linux Enterprise Server SLES Virtualization
1

I have SLES 12 (64 bits) + KVM Host.
Sever connected to intranet with NIC em1 and br0. IP address is 140.10.12.36.

The Guests (Win2k3 and SLES 12). IP adresses is 140.10.12.37 and 140.10.12.38.

From Host I can access intranet, ping VM Guests and connect to it via SSH.
From VM Guest I can only ping Host and other Guests, but cannot access to intranet.

Please help me with connecting VM Guest to the intarnet in the setup described below:

kvmserver1:/ # cat /etc/sysconfig/network/ifcfg-em1
BOOTPROTO=‘none’
ETHTOOL_OPTIONS=’’
MTU=’’
NAME=’’
STARTMODE=‘auto’
DHCLIENT_SET_DEFAULT_ROUTE=‘yes’
USERCONTROL=‘no’
IPADDR=’’
NETMASK=’’
PREFIXLEN=’’

kvmserver1:/ # cat /etc/sysconfig/network/ifcfg-br0
USERCONTROL=‘no’
STARTMODE=‘auto’
BOOTPROTO=‘static’
BRIDGE=‘yes’
BRIDGE_STP=‘off’
BRIDGE_FORWARDDELAY=‘0’
BRIDGE_PORTS=‘em1’
BRIDGE_PORTPRIORITIES=’-’
BRIDGE_PATHCOSTS=’-’
IPADDR=‘140.10.12.36/16’
BROADCAST=’’
ETHTOOL_OPTIONS=’’
MTU=’’
NAME=’’
NETWORK=’’
REMOTE_IPADDR=’’

kvmserver1:/ # route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 140.10.0.100 0.0.0.0 UG 0 0 0 br0
140.10.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br0

kvmserver1:/ # sysctl -p
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0
net.ipv4.conf.default.proxy_arp = 1
net.ipv4.conf.all.proxy_arp = 1
net.ipv4.conf.br0.proxy_arp = 1
net.ipv4.conf.em1.proxy_arp = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.br0.send_redirects = 0
net.ipv4.conf.em1.send_redirects = 0

kvmserver1:/ # brctl show
bridge name bridge id STP enabled interfaces
br0 8000.c81f66baa597 no em1
vnet0
kvmserver1:/ # ip tuntap
vnet0: tap vnet_hdr

Guest xml:

<interface type='bridge'>
  <mac address='52:54:00:19:02:b1'/>
  <source bridge='br0'/>
  <target dev='vnet0'/>
  <model type='virtio'/>
  <alias name='net0'/>
  <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>