KVM hypervisor on dedicated server with only one physical nic and one public ip

Hello,



I am in progress of setting up a dedicated server with only one public IP and one physical NIC.
I would like to use KVM as hypervisor for this setup.


However, I would like to realize a setup that is similar to this one:
http://serverfault.com/questions/353...-accessible-ra

Basically, I want to install a virtual pfsense and put this one in front of the host OS.
So the wan-interface of the pfsense guest would get my public IP, not the physical host running KVM. (is that even possible that a guest would get the public ip and the physical host would have an internal IP behind pfsense?)
To be able to access this host running KVM to manage it over SSH, I would first want to setup a VPN to pfsense that gives me access to a private network containing the host.
Basically a similar setup like described in the article above to avoid putting the esxi vsphere client port open on the internet, but for KVM.

I have been googling for a while to get some info on this, but can't seem to find something that points me in the right direction. I have the feeling this is going to be way more complex to setup than the pfsense scenario.

Any advice from someone, perhaps someone who has already implemented something similar?

Thanks in advance for any help!