Hmmmm. its interesting that only one client is affected... and I imagine youre using the iptables on a gateway and not on this clients machine? Other folks are leveraging the same forwarding?
There is code w/in MM that constructs a URL for the websocket, but since the error itself implies that it's receiving the request (at the appropriate endpoint), yet missing headers, it's as though the headers are being stripped downstream...
Have you made any progress on this in the past 24 hours?
I'm not too experienced w/ Linux specifically, but honestly I'd recommend using nginx to handle your proxying and port translation, in lieu of iptables.