GitList

Browse code

Add chain DOCKER-FORWARD

In 28.0.0, Docker appended to the FORWARD chain - breaking other
applications that had appended their own rules that needed to execute
after Docker's rules.

Move most of Docker's rules out of the filter-FORWARD chain into a
new DOCKER-FORWARD chain, so that Docker can append to DOCKER-FORWARD
without affecting the order of rules in the FORWARD chain.

After daemon startup inserts jumps to DOCKER-USER and DOCKER-FORWARD,
the bridge driver will not touch the FORWARD chain again. DOCKER-INGRESS
is still added to the FORWARD chain, if used, as it was in 27.x and
earlier.

Signed-off-by: Rob Murray <rob.murray@docker.com>

Rob Murray authored on 2025/02/21 21:17:07
Showing 35 changed files

integration-cli/docker_cli_daemon_test.go index 4f4d90e..54ea6fe 100644
integration/network/bridge/iptablesdoc/generated/new-daemon.md index 9fcce6f..a51986e 100644
integration/network/bridge/iptablesdoc/generated/swarm-portmap.md index 1455a26..978031a 100644
integration/network/bridge/iptablesdoc/generated/usernet-internal.md index a071562..ab6fda9 100644
integration/network/bridge/iptablesdoc/generated/usernet-portmap-lo.md index ebec97a..c0f24a2 100644
integration/network/bridge/iptablesdoc/generated/usernet-portmap-natunprot.md index 3d1722b..3b7118e 100644
integration/network/bridge/iptablesdoc/generated/usernet-portmap-noicc.md index 2e0a9de..7687748 100644
integration/network/bridge/iptablesdoc/generated/usernet-portmap-noproxy.md index a75def1..0f6a6b0 100644
integration/network/bridge/iptablesdoc/generated/usernet-portmap-routed.md index 00cbda7..e6ebdc7 100644
integration/network/bridge/iptablesdoc/generated/usernet-portmap.md index d86c5b5..8ca7833 100644
integration/network/bridge/iptablesdoc/iptablesdoc_linux_test.go index 8d90965..ac1cadb 100644
integration/network/bridge/iptablesdoc/templates/new-daemon.md index 3470411..558e4ab 100644
integration/network/bridge/iptablesdoc/templates/swarm-portmap.md index f8943e7..25ccf61 100644
integration/network/bridge/iptablesdoc/templates/usernet-internal.md index 183cb7d..e921568 100644
integration/network/bridge/iptablesdoc/templates/usernet-portmap.md index 62b7669..5023316 100644
libnetwork/drivers/bridge/setup_ip_tables_linux.go index c34a2c1..98da53a 100644
libnetwork/drivers/bridge/setup_ip_tables_linux_test.go index 7ae8a49..5a7ea8f 100644
libnetwork/firewall_linux_test.go index 57c94f4..2f6f533 100644
libnetwork/iptables/iptables.go index 33f23e9..bd7688e 100644
libnetwork/testdata/TestUserChain_iptables-true_append-false_dockerfwdafter4 index 0000000..67db902
libnetwork/testdata/TestUserChain_iptables-true_append-false_dockerfwdafter6 index 0000000..3435aee
libnetwork/testdata/TestUserChain_iptables-true_append-false_dockerfwdinit4 index 0000000..67db902
libnetwork/testdata/TestUserChain_iptables-true_append-false_dockerfwdinit6 index 0000000..3435aee
libnetwork/testdata/TestUserChain_iptables-true_append-false_fwdafter4 index b61fcf7..171b85d 100644
libnetwork/testdata/TestUserChain_iptables-true_append-false_fwdafter6 index de4a8d2..171b85d 100644
libnetwork/testdata/TestUserChain_iptables-true_append-false_fwdinit4 index b61fcf7..171b85d 100644
libnetwork/testdata/TestUserChain_iptables-true_append-false_fwdinit6 index de4a8d2..171b85d 100644
libnetwork/testdata/TestUserChain_iptables-true_append-true_dockerfwdafter4 index 0000000..67db902
libnetwork/testdata/TestUserChain_iptables-true_append-true_dockerfwdafter6 index 0000000..3435aee
libnetwork/testdata/TestUserChain_iptables-true_append-true_dockerfwdinit4 index 0000000..67db902
libnetwork/testdata/TestUserChain_iptables-true_append-true_dockerfwdinit6 index 0000000..3435aee
libnetwork/testdata/TestUserChain_iptables-true_append-true_fwdafter4 index c5158c5..90c2f19 100644
libnetwork/testdata/TestUserChain_iptables-true_append-true_fwdafter6 index bd6c40b..90c2f19 100644
libnetwork/testdata/TestUserChain_iptables-true_append-true_fwdinit4 index b61fcf7..171b85d 100644
libnetwork/testdata/TestUserChain_iptables-true_append-true_fwdinit6 index de4a8d2..171b85d 100644

@@ -30,6 +30,7 @@ import (
                      	"github.com/docker/docker/integration-cli/cli"
                      	"github.com/docker/docker/integration-cli/cli/build"
                      	"github.com/docker/docker/integration-cli/daemon"
                     +	"github.com/docker/docker/libnetwork/drivers/bridge"
                      	"github.com/docker/docker/libnetwork/iptables"
                      	"github.com/docker/docker/opts"
                      	"github.com/docker/docker/testutil"
@@ -718,7 +719,7 @@ func (s *DockerDaemonSuite) TestDaemonICCPing(c *testing.T) {
                      	d.StartWithBusybox(testutil.GetContext(c), c, "--bridge", bridgeName, "--icc=false")
                      	defer d.Restart(c)
                     -	result := icmd.RunCommand("sh", "-c", "iptables -vL FORWARD | grep DROP")
                     +	result := icmd.RunCommand("sh", "-c", "iptables -vL "+bridge.DockerForwardChain+" | grep DROP")
                      	result.Assert(c, icmd.Success)
                      	// strip whitespace and newlines to verify we only found a single DROP
@@ -769,7 +770,7 @@ func (s *DockerDaemonSuite) TestDaemonICCLinkExpose(c *testing.T) {
                      	d.StartWithBusybox(testutil.GetContext(c), c, "--bridge", bridgeName, "--icc=false")
                      	defer d.Restart(c)
                     -	result := icmd.RunCommand("sh", "-c", "iptables -vL FORWARD | grep DROP")
                     +	result := icmd.RunCommand("sh", "-c", "iptables -vL "+bridge.DockerForwardChain+" | grep DROP")
                      	result.Assert(c, icmd.Success)
                      	// strip whitespace and newlines to verify we only found a single DROP

@@ -11,10 +11,7 @@ Table `filter`:
                          Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
                          num   pkts bytes target     prot opt in     out     source               destination
 0     0 DOCKER-USER  0    --  *      *       0.0.0.0/0            0.0.0.0/0
                     -    2        0     0 ACCEPT     0    --  *      *       0.0.0.0/0            0.0.0.0/0            match-set docker-ext-bridges-v4 dst ctstate RELATED,ESTABLISHED
                     -    3        0     0 DOCKER-ISOLATION-STAGE-1  0    --  *      *       0.0.0.0/0            0.0.0.0/0
                     -    4        0     0 DOCKER     0    --  *      *       0.0.0.0/0            0.0.0.0/0            match-set docker-ext-bridges-v4 dst
                     -    5        0     0 ACCEPT     0    --  docker0 *       0.0.0.0/0            0.0.0.0/0
                     +    2        0     0 DOCKER-FORWARD  0    --  *      *       0.0.0.0/0            0.0.0.0/0
                          Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
                          num   pkts bytes target     prot opt in     out     source               destination
@@ -23,6 +20,13 @@ Table `filter`:
                          num   pkts bytes target     prot opt in     out     source               destination
 0     0 DROP       0    --  !docker0 docker0  0.0.0.0/0            0.0.0.0/0
                     +    Chain DOCKER-FORWARD (1 references)
                     +    num   pkts bytes target     prot opt in     out     source               destination
                     +    1        0     0 ACCEPT     0    --  *      *       0.0.0.0/0            0.0.0.0/0            match-set docker-ext-bridges-v4 dst ctstate RELATED,ESTABLISHED
                     +    2        0     0 DOCKER-ISOLATION-STAGE-1  0    --  *      *       0.0.0.0/0            0.0.0.0/0
                     +    3        0     0 DOCKER     0    --  *      *       0.0.0.0/0            0.0.0.0/0            match-set docker-ext-bridges-v4 dst
                     +    4        0     0 ACCEPT     0    --  docker0 *       0.0.0.0/0            0.0.0.0/0
+                    +
                          Chain DOCKER-ISOLATION-STAGE-1 (1 references)
                          num   pkts bytes target     prot opt in     out     source               destination
 0     0 DOCKER-ISOLATION-STAGE-2  0    --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
@@ -43,15 +47,17 @@ Table `filter`:
                          -P FORWARD ACCEPT
                          -P OUTPUT ACCEPT
                          -N DOCKER
                     +    -N DOCKER-FORWARD
                          -N DOCKER-ISOLATION-STAGE-1
                          -N DOCKER-ISOLATION-STAGE-2
                          -N DOCKER-USER
                          -A FORWARD -j DOCKER-USER
                     -    -A FORWARD -m set --match-set docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
                     -    -A FORWARD -j DOCKER-ISOLATION-STAGE-1
                     -    -A FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER
                     -    -A FORWARD -i docker0 -j ACCEPT
                     +    -A FORWARD -j DOCKER-FORWARD
                          -A DOCKER ! -i docker0 -o docker0 -j DROP
                     +    -A DOCKER-FORWARD -m set --match-set docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
                     +    -A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1
                     +    -A DOCKER-FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER
                     +    -A DOCKER-FORWARD -i docker0 -j ACCEPT
                          -A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
                          -A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
                          -A DOCKER-USER -j RETURN
@@ -76,18 +82,29 @@ The FORWARD chain rules are numbered in the output above, they are:
                           Docker won't add rules to the DOCKER-USER chain, it's only for user-defined rules.
                           It's (mostly) kept at the top of the by deleting it and re-creating after each
                           new network is created, while traffic may be running for other networks.
                     -  2. Early ACCEPT for any RELATED,ESTABLISHED traffic to a docker bridge. This rule
                     +  2. Unconditional jump to DOCKER-FORWARD.
                     +     This is set up by libnetwork, in [setupUserChain][10].
+                    +
                     +Once the daemon has initialised, it doesn't touch these rules. Users are free to
                     +append rules to the FORWARD chain, and they'll run after DOCKER's rules (or to
                     +the DOCKER-USER chain, for rules that run before DOCKER's).
+                    +
                     +The DOCKER-FORWARD chain contains the first stage of Docker's filter rules. Initial
                     +rules are inserted at the top of the table, then not touched. Per-network rules
                     +are appended.
+                    +
                     +  1. Early ACCEPT for any RELATED,ESTABLISHED traffic to a docker bridge. This rule
                           matches against an `ipset` called `docker-ext-bridges-v4` (`v6` for IPv6). The
                           set contains the CIDR address of each docker network, and it is updated as networks
                           are created and deleted. This rule is created during driver initialisation, in
                           `setupIPChains`.
                     -  3. Unconditional jump to DOCKER-ISOLATION-STAGE-1.
                     +  2. Unconditional jump to DOCKER-ISOLATION-STAGE-1.
                           Also created during driver initialisation, in `setupIPChains`.
                     -  4. Jump to DOCKER, for any packet destined for any bridge network, identified by
                     +  3. Jump to DOCKER, for any packet destined for any bridge network, identified by
                           matching against the `docker-ext-bridge-v[46]` set.
                           Also created during driver initialisation, in `setupIPChains`.
                           The DOCKER chain implements per-port/protocol filtering for each container.
                     -  5. ACCEPT any packet leaving a network, set up when the network is created, in
                     +  4. ACCEPT any packet leaving a network, set up when the network is created, in
                           `setupIPTablesInternal`. Note that this accepts any packet leaving the
                           network that's made it through the DOCKER and isolation chains, whether the
                           destination is external or another network.

@@ -193,27 +193,25 @@ var index = []section{
                      type iptCmdType = string
                      const (
                     -	iptCmdLFilter4        iptCmdType = "LFilter4"
                     -	iptCmdSFilter4        iptCmdType = "SFilter4"
                     -	iptCmdLFilterDocker4  iptCmdType = "LFilterDocker4"
                     -	iptCmdSFilterForward4 iptCmdType = "SFilterForward4"
                     -	iptCmdSFilterDocker4  iptCmdType = "SFilterDocker4"
                     -	iptCmdLNat4           iptCmdType = "LNat4"
                     -	iptCmdSNat4           iptCmdType = "SNat4"
                     -	iptCmdLRaw4           iptCmdType = "LRaw4"
                     -	iptCmdSRaw4           iptCmdType = "SRaw4"
                     +	iptCmdLFilter4       iptCmdType = "LFilter4"
                     +	iptCmdSFilter4       iptCmdType = "SFilter4"
                     +	iptCmdLFilterDocker4 iptCmdType = "LFilterDocker4"
                     +	iptCmdSFilterDocker4 iptCmdType = "SFilterDocker4"
                     +	iptCmdLNat4          iptCmdType = "LNat4"
                     +	iptCmdSNat4          iptCmdType = "SNat4"
                     +	iptCmdLRaw4          iptCmdType = "LRaw4"
                     +	iptCmdSRaw4          iptCmdType = "SRaw4"
+                     )
                      var iptCmds = map[iptCmdType][]string{
                     -	iptCmdLFilter4:        {"iptables", "-nvL", "--line-numbers", "-t", "filter"},
                     -	iptCmdSFilter4:        {"iptables", "-S", "-t", "filter"},
                     -	iptCmdSFilterForward4: {"iptables", "-S", "FORWARD"},
                     -	iptCmdLFilterDocker4:  {"iptables", "-nvL", "DOCKER", "--line-numbers", "-t", "filter"},
                     -	iptCmdSFilterDocker4:  {"iptables", "-S", "DOCKER"},
                     -	iptCmdLNat4:           {"iptables", "-nvL", "--line-numbers", "-t", "nat"},
                     -	iptCmdSNat4:           {"iptables", "-S", "-t", "nat"},
                     -	iptCmdLRaw4:           {"iptables", "-nvL", "--line-numbers", "-t", "raw"},
                     -	iptCmdSRaw4:           {"iptables", "-S", "-t", "raw"},
                     +	iptCmdLFilter4:       {"iptables", "-nvL", "--line-numbers", "-t", "filter"},
                     +	iptCmdSFilter4:       {"iptables", "-S", "-t", "filter"},
                     +	iptCmdLFilterDocker4: {"iptables", "-nvL", "DOCKER", "--line-numbers", "-t", "filter"},
                     +	iptCmdSFilterDocker4: {"iptables", "-S", "DOCKER"},
                     +	iptCmdLNat4:          {"iptables", "-nvL", "--line-numbers", "-t", "nat"},
                     +	iptCmdSNat4:          {"iptables", "-S", "-t", "nat"},
                     +	iptCmdLRaw4:          {"iptables", "-nvL", "--line-numbers", "-t", "raw"},
                     +	iptCmdSRaw4:          {"iptables", "-S", "-t", "raw"},
+                     }
                      func TestBridgeIptablesDoc(t *testing.T) {

@@ -20,7 +20,7 @@ Note that:
                       - There's a bridge network called `docker_gwbridge` for swarm ingress.
                         - Its rules follow the usual pattern for a network with inter-container communication disabled.
                      - There's an additional chain `DOCKER-INGRESS`.
                     -  - The jump to `DOCKER-INGRESS` is in the `FORWARD` chain, after the jump to `DOCKER-USER`.
                     +  - The jump to `DOCKER-INGRESS` is in the `FORWARD` chain.
                      And the corresponding nat table:

@@ -31,7 +31,7 @@ The filter table is updated as follows:
                      By comparison with the [network with external access][1]:
                     -- In the FORWARD chain, there is no ACCEPT rule for outgoing packets (`-i bridgeINC`).
                     +- In the DOCKER-FORWARD chain, there is no ACCEPT rule for outgoing packets (`-i bridgeINC`).
                      - There are no rules for this network in the DOCKER chain.
                      - In DOCKER-ISOLATION-STAGE-1:
                        - Rule 1 drops any packet routed to the network that does not have a source address in the network's subnet.
@@ -39,7 +39,7 @@ By comparison with the [network with external access][1]:
                        - There is no jump to DOCKER-ISOLATION-STAGE-2.
                      - DOCKER-ISOLATION-STAGE-2 is unused.
                     -The only difference between `bridgeICC` and `bridgeNoICC` is the rule in the FORWARD
                     +The only difference between `bridgeICC` and `bridgeNoICC` is the rule in the DOCKER-FORWARD
                      chain. To enable ICC, the rule for packets looping through the bridge is ACCEPT. For
                      no-ICC it's DROP.

@@ -20,7 +20,7 @@ The filter table is updated as follows:
                      Note that:
                     - - In the FORWARD chain, rule 6 for outgoing traffic from the new network has been
                     + - In the DOCKER-FORWARD chain, rule 5 for outgoing traffic from the new network has been
                         appended to the end of the chain.
                       - In the DOCKER-ISOLATION chains, rules equivalent to the docker0 rules have
                         also been inserted for the new bridge.

@@ -18,7 +18,8 @@ import (
                      // DockerChain: DOCKER iptable chain name
                      const (
                     -	DockerChain = "DOCKER"
                     +	DockerChain        = "DOCKER"
                     +	DockerForwardChain = "DOCKER-FORWARD"
                      	// Isolation between bridge networks is achieved in two stages by means
                      	// of the following two chains in the filter table. The first chain matches
@@ -79,6 +80,18 @@ func setupIPChains(config configuration, version iptables.IPVersion) (retErr err
+                     		}
                      	}()
                     +	_, err = iptable.NewChain(DockerForwardChain, iptables.Filter)
                     +	if err != nil {
                     +		return fmt.Errorf("failed to create FILTER chain %s: %v", DockerForwardChain, err)
                     +	}
                     +	defer func() {
                     +		if retErr != nil {
                     +			if err := iptable.RemoveExistingChain(DockerForwardChain, iptables.Filter); err != nil {
                     +				log.G(context.TODO()).Warnf("failed on removing iptables FILTER chain %s on cleanup: %v", DockerForwardChain, err)
                     +			}
                     +		}
                     +	}()
+                    +
                      	_, err = iptable.NewChain(IsolationChain1, iptables.Filter)
                      	if err != nil {
                      		return fmt.Errorf("failed to create FILTER isolation chain: %v", err)
@@ -121,14 +134,32 @@ func setupIPChains(config configuration, version iptables.IPVersion) (retErr err
                      	if version == iptables.IPv6 {
                      		ipsetName = ipsetExtBridges6
+                     	}
                     -	if err := iptable.EnsureJumpRule("FORWARD", DockerChain,
                     +	// Delete rules that may have been added to the FORWARD chain by moby 28.0.0.
                     +	if err := iptable.DeleteJumpRule("FORWARD", DockerChain,
                      		"-m", "set", "--match-set", ipsetName, "dst"); err != nil {
                      		return fmt.Errorf("%w (kernel module netfilter_xt_set is required)", err)
+                     	}
                     -	if err := iptable.EnsureJumpRule("FORWARD", IsolationChain1); err != nil {
                     +	if err := iptable.DeleteJumpRule("FORWARD", IsolationChain1); err != nil {
                      		return err
+                     	}
                     -	if err := iptable.EnsureJumpRule("FORWARD", "ACCEPT",
                     +	if err := iptable.DeleteJumpRule("FORWARD", "ACCEPT",
                     +		"-m", "set", "--match-set", ipsetName, "dst",
                     +		"-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED",
                     +	); err != nil {
                     +		return err
                     +	}
                     +	// Create rules in the DockerForward chain.
                     +	if err := iptable.EnsureJumpRule("FORWARD", DockerForwardChain); err != nil {
                     +		return err
                     +	}
                     +	if err := iptable.EnsureJumpRule(DockerForwardChain, DockerChain,
                     +		"-m", "set", "--match-set", ipsetName, "dst"); err != nil {
                     +		return err
                     +	}
                     +	if err := iptable.EnsureJumpRule(DockerForwardChain, IsolationChain1); err != nil {
                     +		return err
                     +	}
                     +	if err := iptable.EnsureJumpRule(DockerForwardChain, "ACCEPT",
                      		"-m", "set", "--match-set", ipsetName, "dst",
                      		"-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED",
                      	); err != nil {
@@ -452,25 +483,32 @@ func setupNonInternalNetworkRules(ipVer iptables.IPVersion, config *networkConfi
                      	// to ACCEPT packets that weren't ICC - an extra rule was needed to enable
                      	// ICC if needed. Those rules are now combined. So, outRuleNoICC is only
                      	// needed for ICC=false, along with the DROP rule for ICC added by setIcc.
                     -	outRuleNoICC := iptables.Rule{IPVer: ipVer, Table: iptables.Filter, Chain: "FORWARD", Args: []string{
                     +	outRuleNoICC := iptables.Rule{IPVer: ipVer, Table: iptables.Filter, Chain: DockerForwardChain, Args: []string{
                      		"-i", config.BridgeName,
                      		"!", "-o", config.BridgeName,
                      		"-j", "ACCEPT",
                      	}}
                     -	if config.EnableICC {
                     -		// Remove the legacy rule for ICC (which didn't accept outgoing traffic), if one has been
                     -		// left behind by an old daemon.
                     -		if err := outRuleNoICC.Delete(); err != nil {
                     -			return err
                     +	// If there's a version of outRuleNoICC in the FORWARD chain, created by moby 28.0.0 or older, delete it.
                     +	if enable {
                     +		if err := outRuleNoICC.WithChain("FORWARD").Delete(); err != nil {
                     +			return fmt.Errorf("deleting FORWARD chain outRuleNoICC: %w", err)
+                     		}
                     +	}
                     +	if config.EnableICC {
                      		// Accept outgoing traffic to anywhere, including other containers on this bridge.
                     -		outRuleICC := iptables.Rule{IPVer: ipVer, Table: iptables.Filter, Chain: "FORWARD", Args: []string{
                     +		outRuleICC := iptables.Rule{IPVer: ipVer, Table: iptables.Filter, Chain: DockerForwardChain, Args: []string{
                      			"-i", config.BridgeName,
                      			"-j", "ACCEPT",
                      		}}
                      		if err := appendOrDelChainRule(outRuleICC, "ACCEPT OUTGOING", enable); err != nil {
                      			return err
+                     		}
                     +		// If there's a version of outRuleICC in the FORWARD chain, created by moby 28.0.0 or older, delete it.
                     +		if enable {
                     +			if err := outRuleICC.WithChain("FORWARD").Delete(); err != nil {
                     +				return fmt.Errorf("deleting FORWARD chain outRuleICC: %w", err)
                     +			}
                     +		}
                      	} else {
                      		// Accept outgoing traffic to anywhere, apart from other containers on this bridge.
                      		// setIcc added a DROP rule for ICC traffic.
@@ -510,8 +548,8 @@ func appendOrDelChainRule(rule iptables.Rule, ruleDescr string, append bool) err
                      func setIcc(version iptables.IPVersion, bridgeIface string, iccEnable, internal, insert bool) error {
                      	args := []string{"-i", bridgeIface, "-o", bridgeIface, "-j"}
                     -	acceptRule := iptables.Rule{IPVer: version, Table: iptables.Filter, Chain: "FORWARD", Args: append(args, "ACCEPT")}
                     -	dropRule := iptables.Rule{IPVer: version, Table: iptables.Filter, Chain: "FORWARD", Args: append(args, "DROP")}
                     +	acceptRule := iptables.Rule{IPVer: version, Table: iptables.Filter, Chain: DockerForwardChain, Args: append(args, "ACCEPT")}
                     +	dropRule := iptables.Rule{IPVer: version, Table: iptables.Filter, Chain: DockerForwardChain, Args: append(args, "DROP")}
                      	// The accept rule is no longer required for a bridge with external connectivity, because
                      	// ICC traffic is allowed by the outgoing-packets rule created by setupIptablesInternal.
@@ -537,6 +575,16 @@ func setIcc(version iptables.IPVersion, bridgeIface string, iccEnable, internal,
                      			log.G(context.TODO()).WithError(err).Warn("Failed to delete ICC drop rule")
+                     		}
+                     	}
+                    +
                     +	// Delete rules that may have been inserted into the FORWARD chain by moby 28.0.0 or older.
                     +	if insert {
                     +		if err := acceptRule.WithChain("FORWARD").Delete(); err != nil {
                     +			return fmt.Errorf("deleting FORWARD chain accept rule: %w", err)
                     +		}
                     +		if err := dropRule.WithChain("FORWARD").Delete(); err != nil {
                     +			return fmt.Errorf("deleting FORWARD chain drop rule: %w", err)
                     +		}
                     +	}
                      	return nil
+                     }
@@ -617,6 +665,7 @@ func removeIPChains(version iptables.IPVersion) {
                      	for _, chainInfo := range []iptables.ChainInfo{
                      		{Name: DockerChain, Table: iptables.Nat, IPVersion: version},
                      		{Name: DockerChain, Table: iptables.Filter, IPVersion: version},
                     +		{Name: DockerForwardChain, Table: iptables.Filter, IPVersion: version},
                      		{Name: IsolationChain1, Table: iptables.Filter, IPVersion: version},
                      		{Name: IsolationChain2, Table: iptables.Filter, IPVersion: version},
                      		{Name: oldIsolationChain, Table: iptables.Filter, IPVersion: version},

@@ -53,18 +53,20 @@ func TestProgramIPTable(t *testing.T) {
+                     	}
                      	createTestBridge(getBasicTestConfig(), &bridgeInterface{nlh: nh}, t)
                     +	_, err = iptables.GetIptable(iptables.IPv4).NewChain(DockerForwardChain, iptables.Filter)
                     +	assert.NilError(t, err)
                      	// Store various iptables chain rules we care for.
                      	rules := []struct {
                      		rule  iptables.Rule
                      		descr string
                      	}{
                     -		{iptables.Rule{IPVer: iptables.IPv4, Table: iptables.Filter, Chain: "FORWARD", Args: []string{"-d", "127.1.2.3", "-i", "lo", "-o", "lo", "-j", "DROP"}}, "Test Loopback"},
                     +		{iptables.Rule{IPVer: iptables.IPv4, Table: iptables.Filter, Chain: DockerForwardChain, Args: []string{"-d", "127.1.2.3", "-i", "lo", "-o", "lo", "-j", "DROP"}}, "Test Loopback"},
                      		{iptables.Rule{IPVer: iptables.IPv4, Table: iptables.Nat, Chain: "POSTROUTING", Args: []string{"-s", iptablesTestBridgeIP, "!", "-o", DefaultBridgeName, "-j", "MASQUERADE"}}, "NAT Test"},
                     -		{iptables.Rule{IPVer: iptables.IPv4, Table: iptables.Filter, Chain: "FORWARD", Args: []string{"-o", DefaultBridgeName, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"}}, "Test ACCEPT INCOMING"},
                     -		{iptables.Rule{IPVer: iptables.IPv4, Table: iptables.Filter, Chain: "FORWARD", Args: []string{"-i", DefaultBridgeName, "!", "-o", DefaultBridgeName, "-j", "ACCEPT"}}, "Test ACCEPT NON_ICC OUTGOING"},
                     -		{iptables.Rule{IPVer: iptables.IPv4, Table: iptables.Filter, Chain: "FORWARD", Args: []string{"-i", DefaultBridgeName, "-o", DefaultBridgeName, "-j", "ACCEPT"}}, "Test enable ICC"},
                     -		{iptables.Rule{IPVer: iptables.IPv4, Table: iptables.Filter, Chain: "FORWARD", Args: []string{"-i", DefaultBridgeName, "-o", DefaultBridgeName, "-j", "DROP"}}, "Test disable ICC"},
                     +		{iptables.Rule{IPVer: iptables.IPv4, Table: iptables.Filter, Chain: DockerForwardChain, Args: []string{"-o", DefaultBridgeName, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"}}, "Test ACCEPT INCOMING"},
                     +		{iptables.Rule{IPVer: iptables.IPv4, Table: iptables.Filter, Chain: DockerForwardChain, Args: []string{"-i", DefaultBridgeName, "!", "-o", DefaultBridgeName, "-j", "ACCEPT"}}, "Test ACCEPT NON_ICC OUTGOING"},
                     +		{iptables.Rule{IPVer: iptables.IPv4, Table: iptables.Filter, Chain: DockerForwardChain, Args: []string{"-i", DefaultBridgeName, "-o", DefaultBridgeName, "-j", "ACCEPT"}}, "Test enable ICC"},
                     +		{iptables.Rule{IPVer: iptables.IPv4, Table: iptables.Filter, Chain: DockerForwardChain, Args: []string{"-i", DefaultBridgeName, "-o", DefaultBridgeName, "-j", "DROP"}}, "Test disable ICC"},
+                     	}
                      	// Assert the chain rules' insertion and removal.
@@ -138,6 +140,8 @@ func createTestBridge(config *networkConfiguration, br *bridgeInterface, t *test
                      // Assert base function which pushes iptables chain rules on insertion and removal.
                      func assertIPTableChainProgramming(rule iptables.Rule, descr string, t *testing.T) {
                     +	t.Helper()
+                    +
                      	// Add
                      	if err := programChainRule(rule, descr, true); err != nil {
                      		t.Fatalf("Failed to program iptable rule %s: %s", descr, err.Error())

@@ -4,6 +4,8 @@ import (
                      	"fmt"
                      	"testing"
                     +	"github.com/docker/docker/libnetwork/drivers/bridge"
+                    +
                      	"github.com/docker/docker/internal/testutils/netnsutils"
                      	"github.com/docker/docker/libnetwork/config"
                      	"github.com/docker/docker/libnetwork/iptables"
@@ -62,6 +64,15 @@ func TestUserChain(t *testing.T) {
                      				fmt.Sprintf("TestUserChain_iptables-%v_append-%v_fwdinit4", tc.iptables, tc.append))
                      			golden.Assert(t, getRules(t, iptable6, fwdChainName),
                      				fmt.Sprintf("TestUserChain_iptables-%v_append-%v_fwdinit6", tc.iptables, tc.append))
                     +			if tc.iptables {
                     +				golden.Assert(t, getRules(t, iptable4, bridge.DockerForwardChain),
                     +					fmt.Sprintf("TestUserChain_iptables-%v_append-%v_dockerfwdinit4", tc.iptables, tc.append))
                     +				golden.Assert(t, getRules(t, iptable6, bridge.DockerForwardChain),
                     +					fmt.Sprintf("TestUserChain_iptables-%v_append-%v_dockerfwdinit6", tc.iptables, tc.append))
                     +			} else {
                     +				assert.Check(t, !iptables.GetIptable(iptables.IPv4).ExistChain(bridge.DockerForwardChain, fwdChainName),
                     +					"Chain %s should not exist", bridge.DockerForwardChain)
                     +			}
                      			if tc.append {
                      				_, err := iptable4.Raw("-A", fwdChainName, "-j", "DROP")
@@ -75,6 +86,15 @@ func TestUserChain(t *testing.T) {
                      				fmt.Sprintf("TestUserChain_iptables-%v_append-%v_fwdafter4", tc.iptables, tc.append))
                      			golden.Assert(t, getRules(t, iptable6, fwdChainName),
                      				fmt.Sprintf("TestUserChain_iptables-%v_append-%v_fwdafter6", tc.iptables, tc.append))
                     +			if tc.iptables {
                     +				golden.Assert(t, getRules(t, iptable4, bridge.DockerForwardChain),
                     +					fmt.Sprintf("TestUserChain_iptables-%v_append-%v_dockerfwdafter4", tc.iptables, tc.append))
                     +				golden.Assert(t, getRules(t, iptable6, bridge.DockerForwardChain),
                     +					fmt.Sprintf("TestUserChain_iptables-%v_append-%v_dockerfwdafter6", tc.iptables, tc.append))
                     +			} else {
                     +				assert.Check(t, !iptables.GetIptable(iptables.IPv4).ExistChain(bridge.DockerForwardChain, fwdChainName),
                     +					"Chain %s should not exist", bridge.DockerForwardChain)
                     +			}
                      			if tc.iptables {
                      				golden.Assert(t, getRules(t, iptable4, usrChainName),

@@ -1,4 +1,5 @@
                     -//go:build linux
                     +// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
                     +//go:build go1.22 && linux
                      package iptables
@@ -8,6 +9,7 @@ import (
                      	"fmt"
                      	"net"
                      	"os/exec"
                     +	"slices"
                      	"strconv"
                      	"strings"
                      	"sync"
@@ -415,15 +417,25 @@ func (iptable IPTable) AddReturnRule(chain string) error {
                      // EnsureJumpRule ensures the jump rule is on top
                      func (iptable IPTable) EnsureJumpRule(fromChain, toChain string, rule ...string) error {
                     +	if err := iptable.DeleteJumpRule(fromChain, toChain, rule...); err != nil {
                     +		return err
                     +	}
                     +	rule = append(rule, "-j", toChain)
                     +	if err := iptable.RawCombinedOutput(append([]string{"-I", fromChain}, rule...)...); err != nil {
                     +		return fmt.Errorf("unable to insert jump to %s rule in %s chain: %v", toChain, fromChain, err)
                     +	}
                     +	return nil
                     +}
+                    +
                     +// DeleteJumpRule deletes a rule added by EnsureJumpRule. It's a no-op if the rule
                     +// doesn't exist.
                     +func (iptable IPTable) DeleteJumpRule(fromChain, toChain string, rule ...string) error {
                      	rule = append(rule, "-j", toChain)
                      	if iptable.Exists(Filter, fromChain, rule...) {
                      		if err := iptable.RawCombinedOutput(append([]string{"-D", fromChain}, rule...)...); err != nil {
                      			return fmt.Errorf("unable to remove jump to %s rule in %s chain: %v", toChain, fromChain, err)
+                     		}
+                     	}
                     -	if err := iptable.RawCombinedOutput(append([]string{"-I", fromChain}, rule...)...); err != nil {
                     -		return fmt.Errorf("unable to insert jump to %s rule in %s chain: %v", toChain, fromChain, err)
                     -	}
                      	return nil
+                     }
@@ -447,6 +459,14 @@ func (r Rule) exec(op Action) error {
                      	return GetIptable(r.IPVer).RawCombinedOutput(r.cmdArgs(op)...)
+                     }
                     +// WithChain returns a version of the rule with its Chain field set to chain.
                     +func (r Rule) WithChain(chain string) Rule {
                     +	wc := r
                     +	wc.Args = slices.Clone(r.Args)
                     +	wc.Chain = chain
                     +	return wc
                     +}
+                    +
                      // Append appends the rule to the end of the chain. If the rule already exists anywhere in the
                      // chain, this is a no-op.
                      func (r Rule) Append() error {

                     new file mode 100644
@@ -0,0 +1,4 @@
                     +-N DOCKER-FORWARD
                     +-A DOCKER-FORWARD -m set --match-set docker-ext-bridges-v6 dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
                     +-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1
                     +-A DOCKER-FORWARD -m set --match-set docker-ext-bridges-v6 dst -j DOCKER