If the state of documentation is not up to date it explains my troubles and I am fine.
My libvirt machine NAT stopped working due to switching to nftables.
The archwiki states I need to allow access to DHCP/DNS via NAT in /etc/nftables.conf.
This doesn't worked.
Found an old forum entry (latest entry 2024) stating I need to define firewall_backend=iptables instead of defaulting to notables because they( adonesp stated ) use iptables-nft.
So my question what is correct in 2026?