Rewrite destination port on forwarded traffic

I need to make this type of rule in iptables:

iptables -t nat -I PREROUTING -p tcp -s 1.2.3.4/32 --destination 5.6.7.8 --dport 123 -j DNAT --to 5.6.7.8:124

Where 5.6.7.8 is a metallb loadbalancer service and 1.2.3.4 is traffic from an interface outside of k8s with forwarded traffic. Basically I want to do special handling for traffic that originates from this interface.

It’s not clear to me how to configure this with calico? As it rewrites my manual iptables rules I’m also unable to just set it with iptables.

A bit related to SNAT port of Kubernetes outgoing traffic