Note 1: It is assumed that the IP of your Debian 9.4 64-bit KVM server is 192.168.1.160. Change this if necessary.
Note 2: It is assumed that the gateway IP of your Debian 9.4 64-bit KVM server is 192.168.1.1. Change this if necessary.
Note 3: It is assumed that the broadcast IP of your Debian 9.4 64-bit KVM server is 192.168.1.255. Change this if necessary.

Setup server for remote access:
1) Install minimal Debian 9.4.0 64-bit. Create a regular user "toor".
2) Remove installation media.
3) # Make sure CD-ROM is commented out in "/etc/apt/sources.list", and that you have configured an official Debian mirror there. Also make sure "contrib" is configured to your Debian mirror.
apt-get -y update
apt-get -y upgrade
apt-get -y install net-tools openssh-server openssh-client
4) vi /etc/network/interfaces # Have the following contents. You may modify the contents if necessary.
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug enp3s0
#iface enp3s0 inet dhcp
iface enp3s0 inet static
address 192.168.1.160
netmask 255.255.255.0
gateway 192.168.1.1
5) shutdown -r now

You may now remotely access the server:
1) ssh [email protected]
su -
2) cp -p /etc/ssh/sshd_config /etc/ssh/sshd_config.orig
vi /etc/ssh/sshd_config # Make sure the following is set:
Port 1015
ListenAddress 0.0.0.0
3) systemctl restart ssh.service
exit
exit
4) ssh -p 1015 [email protected]
su -
apt-get -y install firewalld
# Reference: https://linode.com/docs/security/firewalls/introduction-to-firewalld-on-centos/
ifconfig -a # Determine your interface name.
systemctl status firewalld.service
firewall-cmd --get-default-zone
firewall-cmd --get-active-zones
firewall-cmd --zone=public --list-all
firewall-cmd --zone=public --add-interface=enp3s0 --permanent # Substitute interface if necessary.

# Substitute the "192.168.1.161" IP address in the next command with the IP address you are using for your SSH client:
firewall-cmd --permanent --zone=public --add-rich-rule='
rule family="ipv4"
source address="192.168.1.161/32"
port protocol="tcp" port="1015" accept'

firewall-cmd --reload
firewall-cmd --zone=public --remove-service=ssh --permanent
firewall-cmd --zone=public --remove-service=dhcpv6-client --permanent
firewall-cmd --reload
firewall-cmd --get-active-zones
firewall-cmd --zone=public --list-all

5) # Reference: https://www.cyberciti.biz/faq/install-kvm-server-debian-linux-9-headless-server/
egrep --color 'vmx|svm' /proc/cpuinfo # To confirm if CPU supports virtualization
apt-get -y install qemu-kvm libvirt-clients libvirt-daemon-system bridge-utils libguestfs-tools genisoimage virtinst libosinfo-bin

# If you want normal/regular user "toor" to manage virtual machines:
adduser toor libvirt
adduser toor libvirt-qemu

newgrp libvirt
newgrp libvirt-qemu

vi /etc/network/interfaces # The following should be the contents of the interfaces file. Modify if necessary.
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
#allow-hotplug enp3s0
#iface enp3s0 inet dhcp
#iface enp3s0 inet static
# address 192.168.1.160
# netmask 255.255.255.0
# gateway 192.168.1.1

auto enp3s0
iface enp3s0 inet manual

auto br0
iface br0 inet static
address 192.168.1.160
broadcast 192.168.1.255
netmask 255.255.255.0
gateway 192.168.1.1
# network 192.168.1.0
bridge_ports enp3s0
bridge_stp off # disable Spanning Tree Protocol
bridge_waitport 0 # no delay before a port becomes available
bridge_fd 0 # no forwarding delay
# bridge_fd 9
# bridge_hello 2
# bridge_maxage 12

#EOF interfaces
6) shutdown -r now
7) ssh -p 1015 [email protected]
su -
vi /root/bridged.xml #Content of file bridged.xml is following:
<network>
<name>br0</name>
<forward mode="bridge"/>
<bridge name="br0"/>
</network>
8) virsh net-define --file /root/bridged.xml
virsh net-autostart br0
virsh net-start br0
shutdown -r now
9) # Install virt-manager in a client machine with X.org. The following instructions is for a Debian 9.4.0 64-bit client with X.org.
su -
apt-get -y install virt-manager ssh-askpass --no-install-recommends # Make sure CD-ROM is commented out in "/etc/apt/sources.list".
apt-get -y install gir1.2-spice-client-gtk-3.0
exit
# Setup passwordless SSH in client machine(be a regular, non-root user):
ssh-keygen # Client; Use defaults and don't give a password.
scp -P 1015 ~/.ssh/id_rsa.pub [email protected]:~/ # Client
ssh -p 1015 [email protected] # Client
mkdir .ssh ; cat ~/id_rsa.pub >> ~/.ssh/authorized_keys ; chmod 600 ~/.ssh/authorized_keys ; exit # Remote server
ssh -p 1015 [email protected] # Client; You should successfully SSH without a password here.
exit # Remote server
su - # Client
shutdown -r now # Client
10) # The client machine should be able to run virt-manager, and you can add the KVM server into it. Proceed with clicking "File->Add Connection". Use "QEMU/KVM" for the "Hypervisor:". Make sure "Connect to remote host" is ticked. "Method:" should be SSH. You should use the regular. non-root user you made in the KVM server for the "Username:". It is "toor" in this documentation. "Hostname:" should have the port number used by SSH(In this documentation, the value for "Hostname:" is "192.168.1.160:1015". You may modify it if necessary.). You may tick "Autoconnect:" if you like.
11) # When creating a Virtual Machine, please make sure "Virtual network 'br0' : Bridge network" is selected under "Network selection" of the "New VM" window. Upon testing right now, it is in step 5 of 5 of the "New VM" window.