I would also do #1, and I’d probably make it work (loooong time Linux user and persistent debugger).

#2 is probably simpler, both conceptually and technically. NAT and FW config is self-contained, and there are plenty of docs and how-tos.