Seems like some mistake in your internet simulator. If source address changes unexpectedly, there's probably some srcnat rule you overlooked. Well, yes, It all worked out fine IRL. I didn't have time to brush up my internet simulator before deployment, but after thinking it through and using a lot ...