First I'll explain NAT, NAT is the root of all evil. Done

Or just use NAT64? That's the conventional way to do this. Yes a VPN works but it's a tunnel, NAT64 just maps the entire IPv4 internet into v6 space and clients just use native v6 to get out. It's easy to setup on a VPS and there are even public instances. https://nat64.net/

Guys I swear, this time It'll happen. Forreal. I can feel it.

(Good on the EU for recognizing open source solutions as finally being truly viable options)

unexpected lesson, but that umask in a subshell is very clever!