Let's consider a server running MySQL server, listening on 127.0.0.1:3306.
I would now like to give Docker containers running on the same host access to the MySQL server. MySQL would reject incoming connections, since they don't originate from 127.0.0.1, but from the container's IP. I could change the binding address of MySQL to '*', but then I would rely entirely on the firewall to prevent access from other networks. Therefore, I would prefer to keep MySQL listening on 127.0.0.1, and use iptables to "white list" the containers. I am not an iptables expert, so I just tried different combinations, using -t nat INPUT, PREROUTING, POSTROUTING, but couldn't get it to work so far. I also set "net.ipv4.conf.docker0.route_localnet" to 1, since that looks necessary.
How can I make iptables set the source address to 127.0.0.1 for all packets coming on the docker0 interface (or a specific IP or network), and handle the following address translation?