Modular libvirt daemon sockets and the manual iptables NAT/forward rules don't survive a reboot; this re-arms them (safe to do before any VM is started) and starts the three existing VMs.
