Sorry, I think I worded my post wrong. What I 
meant was is there a way to make sure that the DomUs can't access the Dom0, i.e. 
so they are on an isolated network. By default in virt-manager, the Dom0 gets 
attached to each bridge created...
Simply 
don't assign an IP to the bridge device in your dom0.
-Jeff
-----------------------------------------------------------------------
Excellent
And this 
is secure? Could I make it any better by using ebtables or anything like 
that?
I just 
want to be careful as my machine will host guests for trusted clients holding 
sensitive information, as well as non-trusted clients (VPS hosting)
Thanks