Speaking of VyOS, last week I learned—relearned?—how to configue a simple port forward from an interface with an internet routable address, to an internal network on another interface:

$ configure
# set nat destination rule 100 description "Would prefer pfSense!"
# set nat destination rule 100 inbound-interface eth0
# set nat destination rule 100 protocol tcp
# set nat destination rule 100 translation address $TARGET_SERVER
# set nat destination rule 100 translation port $TARGET_PORT

You’ll want to change the rule number to get the order right.