Docker service port filters drops packets from containers in the same network

Summary

Usage of docker_service_port_filter on one container results in drops of packets when trying to connect from another linked container in the same network.

Steps to reproduce

1. Create container/service with docker_service_port_filter.
2. Create another container with --link option.
3. Try to send packets from second to the first one.
4. Observe packet loss.

Expected behavior

Packets between containers in the same network should be sent with no problems.

Actual behavior

Packet are dropped by firewall.

Possible fixes

Change rules to drop anything from sources different than docker0 or br-*. Suggested modifications:

# Add drop to DOCKER-USER if not exist
iptables_ensure \
  filter \
  DOCKER-USER \
  insert \
    ! --in-interface docker0 \
    --out-interface docker0 \
    --match mark \
      --mark 7 \
    --jump DROP

iptables_ensure \
  filter \
  DOCKER-USER \
  insert \
    ! --in-interface br-+ \
    --out-interface br-+ \
    --match mark \
      --mark 7 \
    --jump DROP