From fabdd8010bad8f22576cf2c68cc4a5ad3dc8a5e6 Mon Sep 17 00:00:00 2001
From: Julien Kassar <github@kassisol.com>
Date: Tue, 1 Nov 2016 17:48:40 -0400
Subject: [PATCH] Fix order of rules

---
 docker.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/docker.sh b/docker.sh
index 1354636..c0a5af9 100644
--- a/docker.sh
+++ b/docker.sh
@@ -45,7 +45,6 @@ iptables -N DOCKER-ISOLATION
 
 iptables -t nat -N DOCKER
 
-iptables -A DOCKER-ISOLATION -j RETURN
 iptables -A FORWARD -j DOCKER-ISOLATION
 add_to_forward ${DOCKER_INT}
 
@@ -66,8 +65,8 @@ if [ `echo ${containers} | wc -c` -gt "1" ]; then
 			DOCKER_NET_INT="br-$(docker inspect -f \"{{.NetworkSettings.Networks.${netmode}.NetworkID}}\" ${container} | cut -c -12)"
 			ipaddr=`docker inspect -f "{{.NetworkSettings.Networks.${netmode}.IPAddress}}" ${container}`
 
-			add_to_docker_isolation ${DOCKER_INT} ${DOCKER_NET_INT}
 			add_to_docker_isolation ${DOCKER_NET_INT} ${DOCKER_INT}
+			add_to_docker_isolation ${DOCKER_INT} ${DOCKER_NET_INT}
 
 			for net in `docker network ls | awk '{ print $2 }' | grep -Ev "bridge|host|null|ID|${netmode}"`; do
 				dint="br-$(docker network inspect -f '{{.Id}}' ${net} | cut -c -12)"
@@ -109,3 +108,6 @@ if [ `echo ${containers} | wc -c` -gt "1" ]; then
                 fi
         done
 fi
+
+iptables -A DOCKER-ISOLATION -j RETURN
+iptables -t nat -I DOCKER -i ${DOCKER_INT} -j RETURN