*---*    *---*    *---*
|   |----+---+----+---+----->
|   |    |   |    |   |
|   |--->|   |--->|   |
*---*    *---*    *---*
  1        2        3      inet

1:
client
route to 2 via gw
default route via 2

2:
intermediate server
route to 3 via gw
default route via 3
policy routing to ext ip and from ext ip default route via gw
optional nat for client 1

3:
exit node server
if not nat for client 1 on 2 then route to client networks via 2
default route via gw
nat for client 1 and server 2