From memory and a quick glance at one of my servers:

When an IP packet related to your container arrives (<host ip>:<host port>):

- docker rewrites it to target <your container's ip address>:<your container's port> (NAT table, chain PREROUTING delegates to DOCKER chain with the relevant DNAT entry)

- since the IP does not match your host, the packet is forwarded (there's a relevant routing entry pointing to docker's virtual interface)

- the first thing you encounter in the FORWARD chain of the FILTER table is a few jumps to the docker-related chains, DOCKER chain in particular accepts all packets destined to <your container's ip address>:<your container's port>

So a few takeaways:

- your standard firewall might not be involved because its chains are plugged in after the docker chains in the FORWARD chain (e.g. ufw under Ubuntu)

- if the above is true and you want your firewall to matter, you have to add stuff to DOCKER-USER chain in the FILTER table

- at that point the host port and IP doesn't matter since it's already been mapped in the NAT table's PREROUTE chain at the beginning of processing - write your firewall rules to address specific containers