OK, I've got it!
Thanks to advice from Oliver from OxLug, I've tried this:
iptables -t nat -I PREROUTING X -s Y -j ACCEPT
X == prerouting list number (in my case 1)
Y == ip address of authenticated user
So if "joe" using 192.168.1.120 authenticates, I launce:
iptables -t nat -I PREROUTING...