How to forward ports to lxc containers running inside virtualbox vm?

I've got ubuntu/xenial64 VM with port forwarding set up (config.vm.network "forwarded_port", guest: 80, host: 8080). Inside the VM I've created an lxc container (ubuntu/trusty), and added iptables rule:

iptables -t nat -A PREROUTING -i lxcbr0 -p tcp --dport 80 -j DNAT --to-destination 10.0.3.153:80

And installed one nginx inside the VM, and one inside lxc container, running inside the VM. From outside the VM I can access nginx running inside the VM, but not the one running inside lxc container. To check I use (outside the VM):

curl -sSv localhost:8080

Or:

w3m http://localhost:8080

How can I tell which one responds? I stop the one running inside the VM, and get no response. But I can access nginx running inside lxc container from inside the VM just fine.

What am I doing wrong (except for running lxc containers inside VM's)? :)

Here's output of iptables-save:

# iptables-save                                                                                   [9/858]
# Generated by iptables-save v1.6.0 on Mon Jul 18 22:04:52 2016
*mangle
:PREROUTING ACCEPT [293:22775]
:INPUT ACCEPT [261:20343]
:FORWARD ACCEPT [32:2432]
:OUTPUT ACCEPT [174:19243]
:POSTROUTING ACCEPT [206:21675]
-A POSTROUTING -o lxcbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Mon Jul 18 22:04:52 2016
# Generated by iptables-save v1.6.0 on Mon Jul 18 22:04:52 2016
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i lxcbr0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.3.153:80
-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE
COMMIT
# Completed on Mon Jul 18 22:04:52 2016
# Generated by iptables-save v1.6.0 on Mon Jul 18 22:04:52 2016
*filter
:INPUT ACCEPT [256:19487]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [176:19491]
-A INPUT -i lxcbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i lxcbr0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i lxcbr0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i lxcbr0 -p udp -m udp --dport 67 -j ACCEPT
-A FORWARD -o lxcbr0 -j ACCEPT
-A FORWARD -i lxcbr0 -j ACCEPT
COMMIT
# Completed on Mon Jul 18 22:04:52 2016

Solution

It appears, I added rule for the wrong interface. It's supposed to be eth0, enp0s25, or whatever corresponds to you physical network interface:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.0.3.153:80