Hi,
@jfontan just answered my question via IRC.
Just in case someone has a similar problem. I would like to share the solution with you:
The problem (in my case was) that I had the filter clean-traffic activated in /etc/one/vmm_exec/vmm_exec_kvm.conf:
Before: NIC = [ filter = "clean-traffic", model="virtio" ]
After: NIC = [ model="virtio" ]
This clean-traffic rule is also active even if FILTER_IP_SPOOFING or FILTER_MAC_SPOOFING is set to NO for that specific VNET.
So, if you find something like the following code block this in your virsh dumpxml output, or see ebtables rules with names like I-one-ID-0-rarp or I-one-251-0-ipv4-ip, just have a look into the config.
<filterref filter='clean-traffic'>
<parameter name='IP' value='IP address of the NIC'/>
</filterref>
Bernhard