1d878a8d45
Without -d 192.168.1.10, the DNAT rule intercepted all TCP port 80/443 traffic arriving on vmbr0 — including LAN or routed traffic destined for internal VMs like Pi-hole (10.10.1.2), redirecting it to Traefik instead. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>