quilkin VS rathole

Quilkin should work for this. Set up one client on your VPS, then set up a second client on a host somewhere inside your network. Connect both instances together and have the host on your network forward traffic to the 27016 endpoint

The firewall would need to be able to handle all the DDoS traffic as well, since your current idea would still pass the game server's IP back to a client. This is doable if you're hosting on a cloud provider and let their firewalls filter the traffic before hitting the game server.

Embark Studios recently open sourced (in alpha) a UDP proxy[1] designed for games that lets you implement a load balancing layer. This allows you to remove servers in the load balancing layer in the event that it comes under attack, allowing the game server to stay up and only having to disconnect a portion of players connected to the attacked loadbalancer. Having a proxy layer is also how Steam protects game servers using the Steam Datagram Relay[2].

[1]: https://github.com/googleforgames/quilkin

rathole?

There is also this: https://github.com/rapiz1/rathole

I always struggle with the iptables rules that are needed for that. I recently stumbled on Rathole, which seems to take care of that for this specific usecase, but haven't tried yet. https://github.com/rapiz1/rathole

Rathole is also a simple lightweight solution if you're open to alternatives to haproxy.

Very minimalist, but rathole would work if you have a public facing VPS as well => https://github.com/rapiz1/rathole

If you want to expose a local port on the vps you can use rathole.