A Proxmox host (10.10.10.100) runs an LXC container whose in...

Prompt

A Proxmox host (10.10.10.100) runs an LXC container whose internal service listens on port 7701. External port 443 on the public IP is supposed to DNAT to 10.10.10.100:7701. The operator reports that connections from inside the internal network to the external IP hang, while connections from outside work fine. Diagnose: explain the likely root cause (hairpin NAT), list the exact commands to verify each hop (iptables DNAT rule, conntrack, the container listening socket), and give the fix that makes internal-to-external-IP connections work without breaking external access. Be specific about which tables/chains you would inspect.