Hi A.P!
Port fowarding sound like what i need but i don't know how to configure it so that all traffic flow in the internet line will be came to the firewall VM first, after filter process, legitimate traffic will be pushed to respective production VM