These scripts allow starting qemu without root priveleges and network startup scripts
---br0.sh---
#!/bin/bash

brctl addbr br0
ifconfig <ifname> promisc
ip tuntap add dev <tapname> mode tap user <username> group <group>
ifconfig <tapname> 0.0.0.0 promisc up
brctl addif br0 <ifname> <tapname>
ifconfig br0 hw ether xx:xx:xx:xx:xx:xx up
dhcpcd
---------
---qbr0.sh---
#!/bin/bash
#
# Copyright IBM, Corp. 2010
#
# Authors:
#  Anthony Liguori <aliguori@us.ibm.com>
#
# This work is licensed under the terms of the GNU GPL, version 2.  See
# the COPYING file in the top-level directory.

# Set to the name of your bridge
BRIDGE=qbr0

# Network information
NETWORK=10.1.1.0
NETMASK=255.255.255.0
GATEWAY=10.1.1.1
DHCPRANGE=10.1.1.2,10.1.1.254

# Set correct permissions
USER=<username>
GROUP=kvm

# Optionally parameters to enable PXE support
#TFTPROOT=
#BOOTP=

do_brctl() {
    brctl "$@"
}

do_ifconfig() {
    ifconfig "$@"
}

do_dd() {
    dd "$@"
}

do_iptables_restore() {
    iptables-restore "$@"
}

do_dnsmasq() {
    dnsmasq "$@"
}

check_bridge() {
    if do_brctl show | grep "^$1" > /dev/null 2> /dev/null; then
	return 1
    else
	return 0
    fi
}

create_bridge() {
    do_brctl addbr "$1"
    do_brctl stp "$1" off
    do_brctl setfd "$1" 0
    do_ifconfig "$1" "$GATEWAY" netmask "$NETMASK" up
}

enable_ip_forward() {
    echo 1 | do_dd of=/proc/sys/net/ipv4/ip_forward > /dev/null
}

add_filter_rules() {
do_iptables_restore <<EOF

*nat
-A POSTROUTING -s $NETWORK/$NETMASK -j MASQUERADE
COMMIT

*filter
-A FORWARD -i $1 -o $1 -j ACCEPT
-A FORWARD -s $NETWORK/$NETMASK -i $BRIDGE -j ACCEPT
-A FORWARD -d $NETWORK/$NETMASK -o $BRIDGE -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o $BRIDGE -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i $BRIDGE -j REJECT --reject-with icmp-port-unreachable
COMMIT

EOF
}

start_dnsmasq() {
    do_dnsmasq \
	--strict-order \
	--except-interface=lo \
	--interface=$BRIDGE \
	--listen-address=$GATEWAY \
	--bind-interfaces \
	--dhcp-range=$DHCPRANGE \
	--conf-file="" \
	--pid-file=/var/run/qemu-dnsmasq-$BRIDGE.pid \
	--dhcp-leasefile=/var/run/qemu-dnsmasq-$BRIDGE.leases \
	--dhcp-no-override
}

setup_bridge_nat() {
    if check_bridge "$1" ; then
	create_bridge "$1"
	enable_ip_forward
	add_filter_rules "$1"
	start_dnsmasq "$1"
    fi
}

setup_bridge_vlan() {
    if check_bridge "$1" ; then
	create_bridge "$1"
	start_dnsmasq "$1"
    fi
}

setup_bridge_nat "$BRIDGE"

if test "$1" ; then
    do_ifconfig "$1" 0.0.0.0 up
    do_brctl addif "$BRIDGE" "$1"
fi


# Add 16 TAP devices
ip tuntap add dev qtap0 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap1 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap2 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap3 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap4 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap5 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap6 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap7 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap8 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap9 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap10 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap11 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap12 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap13 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap14 mode tap user "$USER" group "$GROUP"
ip tuntap add dev qtap15 mode tap user "$USER" group "$GROUP"

# Start TAP devices
ifconfig qtap0 0.0.0.0 up
ifconfig qtap1 0.0.0.0 up
ifconfig qtap2 0.0.0.0 up
ifconfig qtap3 0.0.0.0 up
ifconfig qtap4 0.0.0.0 up
ifconfig qtap5 0.0.0.0 up
ifconfig qtap6 0.0.0.0 up
ifconfig qtap7 0.0.0.0 up
ifconfig qtap8 0.0.0.0 up
ifconfig qtap9 0.0.0.0 up
ifconfig qtap10 0.0.0.0 up
ifconfig qtap11 0.0.0.0 up
ifconfig qtap12 0.0.0.0 up
ifconfig qtap13 0.0.0.0 up
ifconfig qtap14 0.0.0.0 up
ifconfig qtap15 0.0.0.0 up

# Add TAP devices to bridge
brctl addif "$BRIDGE" qtap0 qtap1 qtap2 qtap3 qtap4 qtap5 qtap6 qtap7 qtap8 qtap9 qtap10 qtap11 qtap12 qtap13 qtap14 qtap15

# Set correct permissions
setcap CAP_NET_ADMIN=ep /usr/bin/qemu-system-x86_64
---------
---10-qemu.rules---
KERNEL=="1", SUBSYSTEM=="vfio", OWNER="<username>", GROUP="vfio"
ATTR{idVendor}=="0id0", ATTR{idProduct}=="0id0", OWNER:="root", GROUP:="plugdev",MODE:="0660"
---------
---bridge.conf---
allow br0
---------
---test-vm.sh---
#/bin/bash

export QEMU_AUDIO_DRV=alsa
export QEMU_AUDIO_DAC_FIXED_SETTINGS=1
export QEMU_AUDIO_DAC_FIXED_FREQ=48000
export QEMU_AUDIO_ADC_FIXED_SETTINGS=1
export QEMU_AUDIO_ACD_FIXED_FREQ=48000
export QEMU_ALSA_DAC_PERIOD_SIZE=170
export QEMU_ALSA_DAC_BUFFER_SIZE=512

qemu-system-x86_64 \
-nodefaults \
-name 'NAME' \
-enable-kvm \
-monitor stdio \
-rtc base=localtime \
-cpu core2duo,kvm=off,+vmx \
-smp 2,sockets=1,cores=2,threads=1 \
-M q35 \
-m 2G \
-device VGA,id=video0,bus=pcie.0,addr=0x11 \
-display gtk \
-device ich9-usb-ehci1,id=ehci0,bus=pcie.0,addr=0x18.0x7 \
-device ich9-usb-uhci1,id=uhci1,masterbus=ehci0.0,firstport=0,bus=pcie.0,multifunction=on,addr=0x18 \
-device ich9-usb-uhci2,id=uhci2,masterbus=ehci0.0,firstport=2,bus=pcie.0,addr=0x18.0x1 \
-device ich9-usb-uhci3,id=uhci3,masterbus=ehci0.0,firstport=4,bus=pcie.0,addr=0x18.0x2 \
-device usb-tablet,id=tablet0 \
-device virtio-net,netdev=user0,mac=52:54:00:12:34:56,id=int0,bus=pcie.0,addr=16 \
-netdev tap,script=no,downscript=no,ifname=qtap0,vhost=on,id=qtap0 \
-netdev bridge,id=br0 \
-device virtio-net,netdev=br0,mac=52:54:00:12:34:50,id=vnet0,bus=pcie.0,addr=15 \
-netdev socket,id=socket0,mcast=230.0.0.1:1234 \
-device e1000-82545em,netdev=socket0,mac=52:54:00:12:34:51,id=vnet0,bus=pcie.0,addr=15 \
-device ahci,id=ahci0,bus=pcie.0,multifunction=on,addr=0x3.0x0 \
-drive file='*.iso',if=none,media=cdrom,readonly=on,id=drive-sata0-0-1,format=raw -device ide-drive,bus=ahci0.0,drive=drive-sata0-0-1,id=sata0-0-1 \
-drive file='*.qcow2',if=none,media=disk,id=drive-sata0-0-2,format=qcow2 -device ide-drive,bus=ahci0.1,drive=drive-sata0-0-2,id=sata0-0-2


#-netdev socket,id=socket0,mcast=230.0.0.1:1234 \
#-device e1000-82545em,netdev=socket0,mac=52:54:00:12:34:51,id=vnet0,bus=pcie.0,addr=15 \
#-netdev tap,script=no,downscript=no,ifname=qtap1,id=qtap1 \
#-device e1000-82545em,netdev=qtap1,mac=52:54:00:12:34:51,id=vnet0,bus=pcie.0,addr=15 \
#
#-usbdevice host:09da:9090,id=mouse \
#-usbdevice host:04d9:1702,id=keyboard \
#-device ich9-intel-hda,bus=pcie.0,addr=1b.0,id=sound0 \
#-device hda-micro,id=sound0-codec0,bus=sound0.0,cad=0 \
#-device usb-tablet,id=tablet0 \
#-device usb-kbd,id=kbd0 \
#-device usb-mouse,id=mouse0 \
#-drive file='/media/Public/OSes/Microsoft Windows/Windows Server 2008 R2 SP1/UPDATED/WIN2008R2_RU_UPDATED_UEFI.iso',if=none,media=cdrom,readonly=on,id=drive-sata0-0-1,format=raw -device ide-drive,bus=ahci0.0,drive=drive-sata0-0-1,id=sata0-0-1,bootindex=1 \
#-drive file='/media/Public/Software/Linux/Virtual Machines/Qemu-KVM/drivers/VirtIO/virtio-win-0.1.110.iso',if=none,media=cdrom,readonly=on,id=drive-sata0-0-2,format=raw -device ide-drive,bus=ahci0.1,drive=drive-sata0-0-2,id=sata0-0-2,bootindex=2
#-device qxl-vga,id=video0,ram_size=67108864,vram_size=67108864,bus=pcie.0,addr=0x11 \
#-global qxl-vga.revision=4 \
#-netdev bridge,id=br0 \
#-device virtio-net,netdev=br0,mac=00:00:00:FF:FF:12,id=vnet0,bus=pcie.0,addr=15 \
#-netdev user,id=user0 \
#-device virtio-net,netdev=user0,mac=52:54:00:12:34:56,id=int0,bus=pcie.0,addr=16 \
#-netdev tap,script=no,downscript=no,ifname=qtap0,vhost=on,id=qtap0 \
#-device virtio-net,netdev=qtap0,mac=00:00:00:FF:FF:04,id=vnet0,bus=pcie.0,addr=15 \
#-netdev user,restrict=yes,id=user0 \
#-device e1000-82545em,netdev=user0,mac=52:54:00:12:34:57,id=int0,bus=pcie.0,addr=16 \
#-device virtio-balloon-pci,id=balloon0,bus=pcie.0,addr=0x9 \
#-device virtio-rng-pci,id=ring0,bus=pcie.0,addr=0x8 \
#