Hello,
at a first glance this script separates internal and external networks and allows some nodes from internal network move to internet. Is that what you want to realize?
It might happen that I was no to careful but looks like
Internal Network Interface = venet0
Internal Network = is a network your CTs belong to
Internal Network IP Address: Actually HN doesn't have any ip addresses on venet0 so you may assign any ip address
Internal Network Broadcast = venet0 doesn't support broadcasts (veth does) so you may pretend that you have broadcast and assign it