Wiring diagram should be like this:
Gateway (Gateway) rises DHCP and enabled nat.
On the router it is necessary to specify that the addresses will be handing out the gateway (modern firmware this option usually is).
Then, write a script that monitors the addresses handed out by DHCP, in this case the results of the new address learns MAC and IP, and current time (you can write in the dB) and adds the masquerading rule in iptables.
For existing records verified the time difference between the first registration and the current one. If the time is more than an hour, the masquerading rule is removed, if more than 1:15, the rule is added again, and the time is updated to current.
Something like that.