I want to create a VPN instance where:
1) Clients can connect over a public IP
2) All outgoing connections happen over a NAT gateway
To illustrate:
We want to do this because our NAT gateway IP addresses are whitelisted by vendors and it would make local development really easy.
I think the right answer involves configuring IPTables to use a source NAT, but I'm not sure about the details.
Another option might be to set a load balancer in front of OpenVPN? But everything I've read seems to indicate that OpenVPN isn't compatible with load balancing.
In case you use the AWS managed client VPN service called AWS Client VPN, you should be able to do this. The configuration is outlined in the docs [1]. Just use the NAT Gateway instead of the Internet Gateway in step 5.
[1] https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-internet.html