Set up port-forwarding via libvirt's hook
It’s a bad idea using one file to maintain all port-forwarding rules for VMs. In such a traditional environment (without SDN I mean), consider libvirt’s hook mechanism as a more modular way.
For Ubuntu, edit /etc/libvirt/hooks/qemu
and then restart the libvirt-bin
service.