finally finished migrating my VPN chain setup to systemd-networkd. I think the manpages could've been a bit more explicit about the underlying mechanisms (I had to do some digging to find out how it does NAT/masquerading...) but otherwise I really like it.