VM security by going through a transparent proxy VM

[Ulysses_]

One security strategy is to never allow the host to access the internet but only allow VMs, so it is impossible for private data on one's pc to leak to the internet. It is easy to do with an adsl router that has a usb cable which you connect to one VM at a time.

Even better, all VMs can access the internet simultaneously if they are connected to a gateway VM that does NAT from the VMs to the usb ethernet adapter. Firewall rules in the gateway can provide additional protection that is unbeatable: even if a VM gets infected, its ability to connect to the malware's other collaborating sites is still very limited.  

But, IP's are hard to use for rules because some sites use an unknown number of them that varies, eg youtube.  

So the best would be a VM that acts as a transparent proxy instead of a gateway, because then filtering could be domain-name-based rather than IP-based.  TC is ideal for this because it can do it with very little memory.

Could you help me set up TC as a transparent proxy?