It appears that since 0.6.5 and the introduction of the links feature the port proxy that replaces NAT and iptables port forwarding for container port bindings intercepts all connections, even those made from outside the host machine.

I would also like this issue to raise some concerns about this port proxying, mainly for the two following reasons:

1. Firstly, my understand is that this proxying is done in user-space but is not zero-copy. The performance impacts of this can be huge, yet this behavior is not documented anywhere.
2. Secondly, and most importantly, doing port proxying changes the semantics of the listening port. Normally, if the service is not running nothing listens on the port and any connection attempt will fail with a Connection refused error. With the proxy, the connection succeeds before being closed. This prevents mechanisms like port pinging for service monitoring from working properly.

Tagging @jpetazzo and @shykes with which I raised the issue on #docker.