iptables -t nat -I POSTROUTING -p udp -m udp --sport 123 -j MASQUERADE --to-ports 60000-61000

I don't know why I didn't specify the outbound interface but I probably should have (-o $wan_interface), anyway it did the job for a long time.

The breakthrough I needed to get it to work was discovering that --to-ports option, which I'd never used or seen in the wild before facing this problem.