Configure a KVM private NAT with a guest acting as a gateway to the outside world. Internal guests will be accessible from the outside world via a reverse proxy and port-forwarding rules.