Docker and IPtables

TL;DR; By default, docker daemon appends iptables rules for forwarding. For this, it uses a filter chain named DOCKER.

Chain FORWARD (policy DROP)
target     prot opt source               destination
DOCKER     all  --  0.0.0.0/0            0.0.0.0 ...