It sounds like you should probably just go the whole hog and give each user their own network namespace and bridge them to the main network. Then they can run D

It sounds like you should probably just go the whole hog and give each user their own network namespace and bridge them to the main network. Then they can run DHCP and get their own address and do with it what they like. Wouldn't really work for Internet accessible IPv4 addresses, but IPv6 would be fine.