We use nginx for that! It can proxy TCP/UDP in general. You can also have it be your TLS endpoint and then pass stuff back to the backend over plain HTTP, if you trust your VPS, but you don't have to.
nginx can preserve the source IP with its "proxy_protocol" feature, somewhat (might only work for HTTPS; with proxy_protocol, nginx on server A will then set the appropriate header with the IP it gets from server B). Or if you decrypt on the VPS, it can set the appropriate header for you before sending it back to server A.
I've got a guide on how we have ours set up: https://frost.brightfur.net/blog/selfhosting-with-a-bounce-vps-part-1/
-- Frost
Distros that don't have SELinux generally have AppArmor, which is similar, and has the advantage that it doesn't have quite such a boneheaded design getting in the way all the time. :3 So I wouldn't pick a distro just to get SELinux, personally!
(I don't like how SELinux sticks labels on individual files, except those labels are apparently pointless, because there's a tool specifically to go through your whole filesystem and reset all the labels if they get screwed up. Which can happen (e.g. if you mount a home directory that doesn't have the labels of every single file in it set to "this is a home file", because you moved it from a Debian install where that isn't a thing).)
-- Frost