Just a quick update... I found a slight alternative to this that I wanted to share. Please let me know though if you see any issues with this at all that I may be overlooking. So far everything seems good though. 
First step: I created my own bash script named d19-cloudron-snat.sh. What this script does is take the Cloudron Docker subnet and creates the iptables rules to use which go to the failover/additional public IP that has the MX record and reverse DNS set for it:
sudo tee /usr/local/bin/d19-cloudron-snat.sh > /dev/null <<'EOF'
#!/bin/bash
set -e
CLOUDRON_SUBNET="172.18.0.0/16"
INTERFACE="$(ip -o -4 route show to default | awk '{print $5}')"
SNAT_IP="149.56.126.160"
while iptables -t nat -C POSTROUTING -s "$CLOUDRON_SUBNET" -o "$INTERFACE" -j SNAT --to-source "$SNAT_IP" 2>/dev/null; do
iptables -t nat -D POSTROUTING -s "$CLOUDRON_SUBNET" -o "$INTERFACE" -j SNAT --to-source "$SNAT_IP"
done
iptables -t nat -I POSTROUTING 1 -s "$CLOUDRON_SUBNET" -o "$INTERFACE" -j SNAT --to-source "$SNAT_IP"
netfilter-persistent save
EOF
sudo chmod +x /usr/local/bin/d19-cloudron-snat.sh
Then I have a service that is a oneshot service which simply invokes the script above when the Docker service is running:
sudo tee /etc/systemd/system/d19-cloudron-snat.service > /dev/null <<EOF
[Unit]
Description=SNAT all Cloudron Docker traffic to 149.56.126.160
After=docker.service
Requires=docker.service
[Service]
Type=oneshot
ExecStart=/usr/local/bin/d19-cloudron-snat.sh
RemainAfterExit=true
[Install]
WantedBy=multi-user.target
EOF
This results in the following:
-
Out of the two IPv4 addresses on my dedicated server, it sends all outbound traffic from the Cloudron Docker network over the failover/additional IPv4 address that I want to use (and matches the IPv4 address I have set in the Cloudron Network page) instead of the default assigned IPv4 address.
-
I also had run the following commands to disable IPv6 for outbound mail ports only:
sudo ip6tables -I DOCKER-USER 1 -p tcp --dport 25 -j REJECT
sudo ip6tables -I DOCKER-USER 2 -p tcp --dport 465 -j REJECT
sudo ip6tables -I DOCKER-USER 3 -p tcp --dport 587 -j REJECT
Originally by the way, I had the above working but for just the mail container only, however the more I thought about it, it seemed like it'd be easier for troubleshooting if I had directed all outbound traffic from the Docker Cloudron network to the floating IP address instead of just the mail container. That way things are at least consistent. Now if I run something like curl -4 https://ifconfig.me in any of the Docker containers for Cloudron, it will always return the floating IP as intended.
All of this seems to work without issue, but would love any insight you have into this too for me in case I'm accidentally causing any issues.
Because of this IPv6 will sometimes be returned as undefined