Network Configuration on Host/Guest for "routed configuration" with port-forwarding

[dired]

Hello,

My question will be about the /etc/network/interfaces file of the server and especially how to configure guest VM's network.
As we have no idea what the best configuration is, I will describe our attempts to follow the manual first and then ask about one approach that made it the farthest.

We are trying to set up a server with a limited number of guest vms. The server has a fixed ip within the intranet and we are not allowed use any other ip within the intranet (e.g. the server has been assigned to ip 192.168.2.120 and we cannot use 192.168.2.12x for guest vms).
The goal is to have guest vms within a (virtual) special ip-range, and be able to ssh into the guests via a forwarded port on the server

Looking at the "Network Configuration"-part of the proxmox manual, we tried the following:

• "Default Configuration using a Bridge": First thing we tried is to assign the guest vms unused ips of the intranet and this worked perfectly, but we are not allowed to use the "Default Configuration using a Bridge"
• "Routed Configuration": This seems the most promising, we are able to ping from guest to server and from server to guest, we are able to ssh from one to the other. The only thing missing is internet access. Before we can/want continue to look at port-forwarding to make the guest-vm accessible externaly, we have the problem that we cannot get internet access from the guests.
• "Masquerading (NAT) with iptables": From reading the description, this seemed the perfect solution, but we didn't get it working at all using the interfaces-file from the manual and setting the guest vm ip to 10.10.10.2, we couldn't even ping the host or vice-versa.

So we think that "Routed Configuration" is the way to go for us for now, the main questions:

1. How to get internet access from guest vm with our "Routed Configuration"? (What is missing in our configuration so that "we can ping google"?)
2. How to further port-forward the guest port to the vm port? (can using qm --redir work?)
3. Can we even use Routed Configuration for our goal?

Here is the /etc/network/interfaces file from the server:

auto lo
iface lo inet loopback

auto enp0s31f6
iface enp0s31f6 inet static
    address 140.169.161.120
    netmask 255.255.255.128
    gateway 140.169.161.1
    post-up echo 1 > /proc/sys/net/ipv4/conf/enp0s31f6/proxy_arp

auto vmbr0
iface vmbr0 inet static
    address 10.10.10.1
    netmask 255.255.255.0
    bridge_ports none
    bridge_stp off
    bridge_fd 0

And the configuration of the guest vm (it's ubuntu and not managed via /etc/network/interfaces, the values are set inside network manager):

IP: 10.10.10.10
Subnet: 255.255.255.0
Default Route: 10.10.10.1
Primary DNS: 10.10.10.1