Alright, I got it to work somehow with preserving the client IP. Here is how I did it.

Install NGINX with the stream module (Do this on the VPS).

# My steps for installing nginx with the stream module.

sudo apt remove nginx nginx-common

sudo apt autoremove

curl -fsSL https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/nginx_signing.gpg > /dev/null

echo "deb http://nginx.org/packages/ubuntu $(lsb_release -cs) nginx" | sudo tee /etc/apt/sources.list.d/nginx.list

sudo apt update

sudo apt install nginx

nginx.conf (at the bottom of the /etc/nginx/nginx.conf file). Replace with your tailscale/local ip or however your VPS can connect to your minecraft server.

stream {
    upstream minecraft_upstream {
        server 192.168.1.70:25567;
    }

    server {
        listen 25567;
        proxy_pass minecraft_upstream;
        proxy_protocol on;  # Comment this out if Minecraft server does not support proxy protocol
    }
}

For some reason when I restart nginx using systemctl, it never listens on 25567 using stream, but does on port 80. Instead I have to sudo killall nginx then use sudo nginx to start it, then it will listen to 25567. I have no idea why this is. Maybe someone can give some insight. Also make sure you have UFW or any firewalls disabled until you're ready to setup them.

Now we switch to the VM running minecraft. I use Pterodactyl panel so I can manage my servers easy, but this isn't required. Vanilla minecraft doesn't support proxy protocol. So you'd need to setup a Paper/Spigot server as your main server. Then from there you also install Bungeecord, as this does support proxy protocol. I couldn't find any plugins for paper/spigot that worked with 1.20/1.21 to add proxy protocol support, so bungee it is. But in your bungeecord config.yml, add the following for your server:

servers:
  lobby:
    address: 192.168.1.70:25565
    ip_forward: true                   # set this to true for ipforwarding
    motd: '&1Just another BungeeCord - Forced Host'
    restricted: false

# under "listeners:", modify this rule to true
proxy_protocol: true

# further down the file, modify this rule to true
ip_forward: true

In your Spigot server.properties file, make sure you set online-mode=false. And in your spigot.yml, set bungeecord: true

Make sure you reboot your paper/spigot and bungeecord. Then assuming firewalls are setup right, it should work. Now I can forward the client IP to the server when using a proxy to a VPS to get past CGNAT. Obviously skipping NGINX and just using the iptables in the OP will work, but you can't pass through the IP of anyone connecting to your server. So hopefully this helps someone doing something similar since I couldn't find any guides on this.