I am building a setup to run not only headless but connection-less, thus all of my sandboxes will connect to bridges, for basic example:

firejail --noprofile --net=br0 ip=10.99.99.10 bash

Within such a bash shell, I can ping other sandboxes setup with other IPs, and I can ping the host, and the host can ping the sandboxes; perfect! But when I do want to run these sandboxes with the host connected to the outside world, I try to add the host's NIC to the bridge:

sudo brctl addbr br0 enp0s7

and instead of connecting the sandboxes on br0 to the Internet, it cuts the host off from everything outside of itself! What am I missing? I have tried turning STP on, no change. I would rather not use iptables routing as some configurations have it, is there a simple 'route' statement which would do it?