Multiple host and cloud network between them, how to properly setup gateway and dnat?

Question

this is the actual configuration:

• Host1 (public ip1)
• Host2 (public ip2)

each host has these interfaces

• bridge vmbr1 (ip 10.8.0.1 on host1, 10.8.0.2 on host2)
• bridge vmbr2 (ip 192.168.1.1 on both hosts)

vmbr1 is bridged between hosts, so it's a common network with some virtual switches between hosts, vmbr2 is a per-host network to let the vm use the host they're on as a gateway.

Each vm has these veth interfaces:

• eth0 (with ip 10.8.x.x bridged to vmbr1 on host)
• eth1 (with ip 192.168.1.x bridged to vmbr2 on host and set 192.168.1.1 as gateway)

So actually each vm can communicate to a vm on the other hosts via vm's eth0 and connect to internet via eth1. This is a sample network schema: http://i.stack.imgur.com/XhOuQ.png

Each vm gets eth1 ip by dhcp running on each host.

Now, what i want to do, is to let the vm be able to:

• respond to internet requests
• be moved easily from a host to another without changing network config (or at least only gateway)
• respond to requests from both hosts (and more hosts in the future), requests are coming from eth0 and gateway and default route is set to eth1

This is what i've achieved so far:

• 10.8.x.x interface bridging using vde2, each vm can ping vm on other hosts
• gateway the vm on the internet using the host they're running on

What i've tried to do to let them respond to internet requests:

• use dnat and snat together, works but logs and acl won't see real public ip, just internal network ones
• reverse proxy, no go because it will work only on http and pop/imap, i want that to be fully transparent, also it stil shows internal ip in logs
• disable rp_filer in kernel, it accepts connections from eth0, but stuck on SYN_RECV, maybe because it reply on eth1 due the routing table with the default route set to eth1

Is there a way to let the vm respond on eth0 if it receive the request there?

EDIT: i've tried with proxy_arp on host vmbr1, that seemed to work, but if the request is not from the public ip on the host where the machine is, it won't work, because the answer will be from the other machine...