*nat
:PREROUTING ACCEPT [0:0]
## forward ports to container
-A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.5
# [...]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 192.168.1.0/25 -o eth0 -j SNAT --to-source <publicip>
COMMIT

net.ipv4.conf.all.forwarding=1
net.ipv4.conf.all.rp_filter=1
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.conf.default.forwarding=1
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.all.promote_secondaries = 1
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.default.forwarding = 1
net.ipv6.conf.all.proxy_ndp = 1