netcat is used on the libvirt host to connect to the guest

I considered using SSH port forwarding, but SSH port forwarding is more complex.
It would require assigning local port numbers, starting a ssh to the libvirt host, waiting for it to connect, then starting a second ssh to connect through the port forward.