@feld I've done something similar with relayd and pf on OpenBSD not so long ago, but the setup for that isn't friendly either. relayd can do transparent proxy which preserves the source IP, but you end up having two connections on the "edge". One is incoming (to be relayed) and the other one is outgoing, which is something not really ideal.

It was also a pain to setup, because the documentation for that is a single mail in the OpenBSD mailing list from many years ago.