Turns out the rule works perfectly fine, I just forgot to enable IPv4 forwarding in sysctl (in addition to IPv6, which I did enable).