It should be possible, but I searched for a day and cannot get a decent HowTo. There seemed to be a Gateway Setup Assistant, but the Wikipedia link only goes to the server app now. Maybe it is easier than I think, but I cannot get it to work.
The setup should be:
Router <-- USB ethernet --> MAC_GW <-- ethernet --> switch <-> internal network
The MAC_GW is a Mac Mini (OS X Yosemite) with an USB ethernet adapter. Internet access is possible from the Mac Mini over this adapter. WiFi is disabled for now.
I installed the server.app and got the DHCP service running, so machines in the internal network get IP addresses assigned. Unfortunately, the server app doesn't show any settings for gateway, NAT, bridging, firewall. The help function is just as helpful as the Apple features website. :(
Now for the question: What do I have to configure, so machines from the internal network get internet access?
Additionally: How can I setup a firewall to control outside access?
UPDATE: as @Froggard hinted, Internet Sharing worked in giving access to the internal network. However, I have no control over the DHCP addresses given by the server, firewall, user access, etc. The server.app DHCP is turned off now, because it cannot be assigned to the internal network adapter.
Maybe someone can still give details on how to enable firewall or control the components involved?