So tayga was the tool that I came the closest to using last time I looked at this, but rereading http://www.litech.org/tayga/ http://www.litech.org/tayga/ I sti

So tayga was the tool that I came the closest to using last time I looked at this, but rereading http://www.litech.org/tayga/ http://www.litech.org/tayga/ I still don't really follow the configuration (yes I know it's a skill issue but nat44 wasn't this hard), the tun device is... I guess it should be fine, but I don't like needing it, and the whole thing looks very manual (I'd bet that doesn't persist after a reboot) though I guess I should see if someone's packaged up a nice systemd unit that makes it all work. The eBPF one is very interesting and does seem to work the way I expect NAT to work (no extra interfaces, just rewriting packets as they come and go), but is 1. unfinished by its own description, and 2. again a 3rd-party code drop that I'd have to package and ship myself if I wanted to use it. And I can do that, but I really don't like my routers to need fiddling.