[Users] SPICE behind NAT

I have setup a test All-In-One install but it is behind a Linux NAT firewall (IPTables). I have been reading about Spice-Proxy and know the basics of setting it up (install squid, configure the ovirt engine SpiceProxyDefault), however I just wanted to know how I would do this in a NAT situation? Would I install Squid on the firewall? When I configure SpiceProxyDefault on the ovirt-engine, I set it to use the internal IP of the firewall/Squid? Anything else I would possibly need to do? -Alan