[ubuntu] KVM and networking

Hi all,

I have a question about networking and KVM virtualization. I have Ubuntu Server host and client.

I want to know if it's possible to allow client access to the Internet and forward few ports from router's WAN, but disable access to PCs on local network?

The reason I want to do this is to protect local devices in case somebody gains access to my client VM.