OK.
so after reading this page
http://gerrit.ovirt.org/gitweb?p=vdsm.git;a=blob;f=vdsm_hooks/extnet/README;h=0778dbb3ef85c5ae179fb0f6c9ceeabc268abe89;hb=HEAD

BTW: is it in any package?
[root@tekkaman ovirt-engine]# rpm -ql vdsm-hook-extnet
/usr/libexec/vdsm/hooks/before_device_create/50_extnet
/usr/libexec/vdsm/hooks/before_nic_hotplug/50_extnet
[root@tekkaman ovirt-engine]#

before
[root@tekkaman ovirt-engine]# engine-config -g CustomDeviceProperties
CustomDeviceProperties:  version: 3.0
CustomDeviceProperties:  version: 3.1
CustomDeviceProperties:  version: 3.2
CustomDeviceProperties:  version: 3.3
CustomDeviceProperties: {type=interface;prop={SecurityGroups=^(?:(?:[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}, *)*[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}|)$}} version: 3.4

then
[root@tekkaman ovirt-engine]# engine-config -s CustomDeviceProperties='{type=interface;prop={extnet=^[a-zA-Z0-9_ ---]+$}}'
Please select a version:
1. 3.0
2. 3.1
3. 3.2
4. 3.3
5. 3.4
5

after:
[root@tekkaman ovirt-engine]# engine-config -g CustomDeviceProperties
CustomDeviceProperties:  version: 3.0
CustomDeviceProperties:  version: 3.1
CustomDeviceProperties:  version: 3.2
CustomDeviceProperties:  version: 3.3
CustomDeviceProperties: {type=interface;prop={extnet=^[a-zA-Z0-9_ ---]+$}} version: 3.4

# systemctl restart ovirt-engine

BTW: is it correct that what before was security groups is now barely overwritten by extnet? Or is there a syntax with which I can add extnet without deleting security groups (even if I don't understand its usage, possibly with openstack integration based on its name...)

Anyway now in oVirt webadmin I can edit the "natted" vnic profile and inside the dropdown menu (there isn't any header marked like "custom property" or similar, that could be useful....)

shutdown and poweroff vm
start vm

and now it correctly gets the ip 192.168.125.91 defined inside the dhcp range for "natted" network

virsh dumpxml f19
...
    <interface type='network'>
      <mac address='00:1a:4a:a8:01:55'/>
      <source network='natted'/>
      <target dev='vnet0'/>
      <model type='virtio'/>
      <filterref filter='vdsm-no-mac-spoofing'/>
      <link state='up'/>
      <alias name='net0'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
    </interface>
...

The web admin portal gives the corect new ip of the VM, as sent by vdagent.

The VM is able to navigate through Internet and
http://www.whatismyip.com/

gives for example consistent and equal information both using my all-in-one server and my VM
 

Now I'm goint to test if I can solve the openvpn issue

Gianluca