I would also do #1, and I’d probably make it work (loooong time Linux user and persistent debugger).
#2 is probably simpler, both conceptually and technically. NAT and FW config is self-contained, and there are plenty of docs and how-tos.
Note: I’m not a proxmox user, so there could be some proxmox specific spanners… But I doubt it.






Remember KillerFS? Oakland PD remembers!