How to passthrough networking device

[cjts]

I have the following setup and would like to do the following.

vfio passed through linux enviroment on which I would like to nest another qemu 
instance running in user which will run a browser. The vfio environment is 
firewalled off the internet - using iptables mod user but the browser should be 
able to access the internet. I am doing  this as I want to be able to use qemu 
with the gtk,gl=on option (not currently working properly anyway, but that is 
another issue).

I can ssh from the vfio instance and portforward to a proxy but is there any 
way to pass a netdev in a nested way - like a chardev  in the vfio qemu and 
netdev user,somekind of char device?