Linux报文流向：
https://blog.csdn.net/u010246947/article/details/18220221
netfilter对于报文的处理
ip_rcv -> iptables -> ip_rcv_finish
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.4/32 -d 172.17.0.4/32 -p tcp -m tcp --dport 8484 -j MASQUERADE
-A POSTROUTING -s 172.17.0.8/32 -d 172.17.0.8/32 -p tcp -m tcp --dport 8484 -j MASQUERADE
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 28812 -j DNAT --to-destination 172.17.0.8:8484
-A FORWARD -o docker0 -j DOCKER
-A DOCKER -d 172.17.0.8/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8484 -j ACCEPT