Joining the pool kills my Internet

Connection tracking is not necessary to redirect a port. You just need to change the address in both directions, i.e. one -j DNAT rule and another -j SNAT rule. You should also specify the input and output interface with the -i and -o options as appropriate. I’m sure there are plenty examples out there.

EDIT: Hm, per this post it is really not supposed to work. I probably confused it with something else.