Bridged guest accepts incoming connections, no outgoing

[Kyleg]

One guest has its network adapter in "bridge" mode.
It successfully obtains a DHCP lease from the provider.
Incoming connections to the guest (https, ssh, etc) work perfectly and follow all the firewall rules.

The guest can not access anything outside (curl, ping, dns lookups, they all fail)

Here is the host interfaces file:

auto lo
iface lo inet loopback

iface eno1 inet manual

iface eno3 inet manual

auto eno4
iface eno4 inet static
        address  10.10.10.1
        netmask  255.255.255.0
#Cluster

iface eno2 inet manual

auto vmbr0
iface vmbr0 inet static
        address  xxx.yyy.221.84
        netmask  255.255.254.0
        gateway  xxx.yyy.220.1
        bridge_ports eno1
        bridge_stp off
        bridge_fd 0

auto vmbr1
iface vmbr1 inet static
        address  192.168.0.2
        netmask  255.255.255.0
        bridge_ports eno2
        bridge_stp off
        bridge_fd 0

The guest network card is configured as "net1: e1000=32:4E:B5:5A:C75,bridge=vmbr0,firewall=1"

Inside the guest the network configuration is

name@guest:~$ ifconfig -a
ens19     Link encap:Ethernet  HWaddr 32:4e:b5:5a:c7:d5  
          inet addr:xxx.yyy.221.176  Bcast:xxx.yyy.221.255  Mask:255.255.254.0
          inet6 addr: xxxx::yyyy:zzzz:aaaa:bbbb/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:8809 errors:42 dropped:0 overruns:0 frame:42
          TX packets:415 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:726983 (726.9 KB)  TX bytes:89711 (89.7 KB)

lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:10027 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10027 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1
          RX bytes:1757950 (1.7 MB)  TX bytes:1757950 (1.7 MB)

name@guest:~$ ip route | grep default
default via xxx.yyy.220.1 dev ens19

I can make it work if i switch "net1" to nat instead of bridge.
I can also make it work if i disable the firewall at the "datacenter" level.

Does anyone have any suggestions about where i went wrong?

Thanks

 

[Kyleg]

Follow up:

I edited /etc/sysctl.conf to enable the following line:

net.ipv4.ip_forward=1

It seems to be working now.
Was that the appropriate solution? Is that something that SHOULD have fixed the problem, or just a red herring?

Thanks