port forwarding to machines connected to VPS on securenat

[BoredAus]

The best way is to read iptables howto documentation. They are scattered all over the web. Here is one example:
http://www.netfilter.org/documentation/ ... WTO-7.html

Also you noted how all the machines connected are given the same IP address as the server, that is not necessarily the case. IP addresses should be unique that is, no two computers on the same network segment would be sharing the identical IP address otherwise there would be a conflict. In that context, sharing the same subnet maybe more appropriate for typical LAN setup. Better yet, the correct terminology would be IP range or DHCP scope.

[thisjun]

What do you want to restrict?

If you want to restrict the communication within a virtual hub, you can use the access list function.