[colonelxc]

I wondered too, and found this from the debian docs: https://wiki.debian.org/BridgeNetworkConnectionsProxyArp

TL;DR: Some routers don't like it, so layer 3 might work better