Ok - think we have identified the issue.
Set iptables -P FORWARD ACCEPT back to iptables -P FORWARD DROP
- you are using a custom bridge.
- docker network ls
- iptables --list-rules
I expect your lines to look like the first two.
-A DOCKER -d 172.21.0.2/32 ! -i br-6b309bd08e7c -o br-6b309bd08e7c -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.19.0.2/32 ! -i br-edb5b4325218 -o br-edb5b4325218 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.6/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.5/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 9999 -j ACCEPT
If you then ran (br-… to match your above)
iptables -A DOCKER-BRIDGE -o br-6b309bd08e7c -j DOCKER
I would expect it to work.
Not sure on the root cause or the right fix (for custom networks) but for the default docker0 network, you should not be having the problem.