Docker 1.13 defaults IP forwarding to DROP

[bboreham]

This change is in moby/moby#28257. Effects include "pod-to-pod traffic works but pod to Internet does not". It will probably also break most uses of weave expose.

Docker add these rules:

-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT

so we could do something similar for the weave bridge. It needs to take into account the weave-npc rules which already cover traffic onto the weave bridge (if enabled).

[bboreham]

Re-opening because I don't think the rules I added will allow a connection in. See kubernetes/kubernetes#40182 (comment)

[bboreham]

Kubernetes has maintained the line that they don't support Docker 1.13.
#2762 appears to have fixed the non-Kubernetes cases.

[brb]

This (= default DROP policy for the FORWARD chain of the filter table) breaks the awsvpc mode as well.