Docker firewall is rewriting some packets.
This problem shows up when we do address spoofing attacks. If the spoofed address is already part of a network in the topology, the docker NAT is rewriting the source IP.

We need to solve this problem to get address spoofing working across different LANs.