The root cause of the problem is default settings in docker container. More precisely, network settings mode which has bridge mode by default. In bridge mode all incoming connections are seen from inside docker container as coming from the same IP address (which is 172.17.0.1). There are multiple hard forks out there so a foreign node running BCH or other forked bitcoin stuff would connect to your node and try to propagate invalid transaction(s). After few attempts your bitcoin node puts such misbehaving incoming connection in a blacklist. Having one connection banned, your node effectively bans all other incoming connections as they are seemed to come from the same IP address.
Confirmation from a technical point of view (via RPC).
To confirm such situtation we can setup RPC to call bitcoin node. Configuration options such as
-rpcauth can be put into bitcoin.conf file so I skip them here. The command
shows list of blacklisted misbehaving nodes where we can see only one address.
In my case the output was like that
"ban_reason": "node misbehaving"
After a successful diagnosis it's possible to clear blacklist with the following command to temporarily clear blacklist
Having blacklist cleared we can run another test here https://bitnodes.earn.com/#join-the-network and confirm the node is now visible from outside.
Network settings in docker.
The most proper solution.
In my case, running on a Synology NAS, I had to recreate the container to switch off the bridge mode.
Schedule (eg, via cron) a task to clear banned.
Whitelist the only address docker accepts connections from.
Couldn't find a way to permanently implement it.
PS. Can someone tag the topic with a 'nat' and 'docker' tags. It looks like I need some reputation to make it happen.