I’m not a big networking expert, but it looks to me that there is no NAT in your setup. The VPS has a dedicated IP, right? The Docker image is set up with network_mode: host, which shouldn’t put it behind a NAT.
So yeah, maybe it’s the firewall. You don’t have address mapping, but filtering may still be in place.
Here’s another thread where people say that messing with the firewall made their “NAT” unrestricted:
And here’s another post where the author says they were updating the firewall rules.
And here @meskio recommends opening up the ephemeral ports range.
This tool may help diagnose.
I don’t think so. It just tells the proxy from which range of ports it can select ports to use for ICE.
The logs show traffic for individual clients, not the max available bandwidth.