Isn't this covered by this?
post-up iptables -t nat -A POSTROUTING -s '192.168.99.0/24' -o vmbr0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '192.168.99.0/24' -o vmbr0 -j MASQUERADE
which translates to this:
Chain POSTROUTING (policy ACCEPT 1829 packets, 111K...