Provision of original client IP and usage of iptables rules

[palindromo]

Hi,
I am trying to configure docker together with iptables rules. In the default docker settings no rule will take effect, because of the docker FORWARD entries.

Restricting External Container Access with Iptables

3rd iteration on my solution for this, posting here for posterity and to complete this thread. I’ve made this into a full bash script and will provide a link to a blog post which has a more complete intro and description. #!/usr/bin/env bash # Usage: # timeout 10 docker_iptables.sh # # Use the builtin shell timeout utility to prevent infinite loop (see below) if [ ! -x /usr/bin/docker ]; then exit fi # Create a PRE_DOCKER table iptables -N PRE_DOCKER # Default action iptables -I PRE_DO…

In the link there is a workaround described to add a custom table PRE_DOCKER to handle restrictions after docker has started. I tried it and it worked.
But I think in case the script to add the rules after starting docker is not succesfully processed all containers will remain accessible from all the internet.
When we set iptables=false in the docker config, the iptables rules will be active but the client IP is the IP of the Docker bridge.

How can we configure docker to use our existing iptables rules AND provide the original remote / client IP?

Docker 17.03.1 is running on Ubuntu 16.04 LTS.

EDIT: What I want to achieve is that docker provides the remote IP to the container even when docker is configured with iptables = false (I don´t want docker to change / bypass my existing rules)

Thank you in advance for any information.