iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 9000 -j DNAT --to-destination 172.17.0.2
iptables -t nat -A POSTROUTING -p tcp -d 172.17.0.2 --dport 9000 -j SNAT --to-source 172.17.0.3
iptables -A FORWARD -m state -p tcp -d 172.17.0.2 --dport 9000 --state NEW,ESTABLISHED,RELATED -j ACCEPT