2

You are right that the implicit SNAT from the DNAT is happening too late: At that point, the routing decision has already been made, so the correct source IP is used on the incorrect interface. To avoid this, you'll need to go deeper on the policy based routing. A technique described in https://superuser.com/questions/638044/source-based-policy-routing-nat-...


1

docker is "a different machine" and your machine gets a port forward to that machine on localhost. So when the app inside docker listens to 127.0.0.1 that is only valid inside that machine, to connect to it from "outside" you need to listen to the any address. So there is 2 different 127.0.0.1. If you listen to any (0.0.0.0) then it is ...


Only top voted, non community-wiki answers of a minimum length are eligible