Create qemu virtual image file:

qemu-img create virt1 1G

On my laptop for some reasons, no cdrom boot was allowed for the virtual installation,
so the loopback device comes useful to do the installation:

dd if=/dev/cdrom of=sarge-netinst.iso

Now boot the new OS installation (I use Debian GNU/Linux for both real and virtual systems)

qemu virt1 -boot d -cdrom sarge-netinst.iso


Then boot the new system (root or sudoed, as you need root privileges for routing)

qemu virt1 -boot c -n /etc/qemu-ifup


Then for tunneling/firewalling (you should integrate it with all your firewall rules):

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i tun0 -s 0/0 -d 0/0 -j ACCEPT
/bin/echo "1" >/proc/sys/net/ipv4/ip_forward


Thanks Mirkuz www.syscalls.com