You might find the techniques used in Network-Aware Firewall useful. You can use firewall configuration to handle connections differently depending on whether you are connected to your home network or not. Or you can use the same techniquest to do other things, depending on network connection, like bringing up your VPN or not; modifying DNS or hosts file or not; etc.
You know it’s only a matter of time until computers are ‘sold’ by subscription.
I’m not running your configuration so can’t tell you with the assurance that I have it working but Forwarding ports with firewalld appears to address port forwarding to rootless podman using firewalld. If that doesn’t work for you you might need to clarify what your firewalld configuration is that obscures the client IP. I wouldn’t expect a simple port mapping to affect IP address.
Different jurisdictions, different laws. So it’s not true that the new apps will, necessarily, be subject to the exact same laws.
But, even if the new apps will be subject to the exact same laws, they may have a different implementation of age verification that better aligns with your privacy or other concerns.
Neither of which precludes many users just not realizing. Not everyone thinks deeply about legality, privacy, security, equity, etc.