NAT over NAT is it possible

Hi i want to add ipfire as firewall in front of my home assistant box.

The outsite world comes in at port 8000 on my router
Traffic to port 8000 is forwarted to the red port of ipfire PI.
Is it possible from there to NAT it to the green port for ipnumber for port 8123?
I tried all kind of settings and guides but it looks nat over nat is not possible?

Second: The main reason for this ipfire PI i want to make use of geoip rules to only give a few countrys (NL and UK) access to this port so other countrys need to be blocked anyway.

Idea is 2 PI’s that deliver services to protect them by ipfire on a thirt PI (old one but works)

thanks for your thoughts on this

Eelco