Iptables outbound redirect zu forward proxy

$ curl -I http://www.zdf.de
HTTP/1.1 301 Moved Permanently
Date: Mon, 15 Jan 2024 14:06:56 GMT
Location: https://www.zdf.de/
X-Varnish: 283774197

$ curl -I https://www.zdf.de
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

$ curl -vLk https://www.zdf.de 
* Rebuilt URL to: https://www.zdf.de/
*   Trying 23.67.164.215...
* TCP_NODELAY set
* Connected to www.zdf.de (23.67.164.215) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* error:1408F10B:SSL routines:ssl3_get_record:wrong version number
* Closing connection 0
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

#  curl -vLk https:{{comment_single_line_double_slash:0}}
* Uses proxy env variable https_proxy == 'http://proxy.xxx.de:8080/'  
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 172.17.20.254...
* TCP_NODELAY set
* Connected to proxy.xxx.de (172.17.20.254) port 8080 (#0)
* allocate connect buffer!
* Establish HTTP proxy tunnel to www.zdf.de:443
> CONNECT www.zdf.de:443 HTTP/1.1
> Host: www.zdf.de:443
> User-Agent: curl/7.61.1
> Proxy-Connection: Keep-Alive
> 
< HTTP/1.0 200 Connection established
< 
* Proxy replied 200 to CONNECT request
* CONNECT phase completed!
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* CONNECT phase completed!
* CONNECT phase completed!
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [122 bytes data]
* TLSv1.3 (IN), TLS handshake, [no content] (0):
{ [1 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [35 bytes data]
* TLSv1.3 (IN), TLS handshake, [no content] (0):
{ [1 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [3624 bytes data]
* TLSv1.3 (IN), TLS handshake, [no content] (0):
{ [1 bytes data]
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
{ [264 bytes data]
* TLSv1.3 (IN), TLS handshake, [no content] (0):
{ [1 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [52 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, [no content] (0):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=DE; ST=Rheinland-Pfalz; L=Mainz; O=Zweites Deutsches Fernsehen A?R; CN=www.zdf.de
*  start date: May  9 00:00:00 2023 GMT
*  expire date: May  8 23:59:59 2024 GMT
*  issuer: C=US; O=DigiCert Inc; CN=DigiCert TLS RSA SHA256 2020 CA1
*  SSL certificate verify ok.
} [5 bytes data]
* TLSv1.3 (OUT), TLS app data, [no content] (0):
} [1 bytes data]
> GET / HTTP/1.1
> Host: www.zdf.de
> User-Agent: curl/7.61.1