[CentOS] KVM host question about host firewall

Hello All:
   I'll ask this in the virt list later if this is not the appropriate forum...

   Yesterday I was troubleshooting an issue with a KVM host. I was
unable to access the DNS service on a KVM virtual machine. After
verifying that the vm allowed through the DNS ports (53 on UDP/TCP)
and still being unable to access, I was able to connect immediately
after allowing those ports on the KVM host.  Is there anyway around
this?  The reason is that I would like to allow only SSH access to the
host, but allow other services to the virtual machines.

   I am running CentOS 5.5 on both hosts and vm.

 Thanks,
Kwan