From b7715289422de77fa7445febc8f1f379a9a98149 Mon Sep 17 00:00:00 2001
From: Bryan Boreham <bjboreham@gmail.com>
Date: Thu, 21 May 2015 10:03:51 +0100
Subject: [PATCH] Check if Docker using weave bridge before inserting DROP rule
 and comment the use of -I

---
 weave | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/weave b/weave
index 4e2a50e6..d929efee 100755
--- a/weave
+++ b/weave
@@ -261,7 +261,10 @@ create_bridge() {
         ip link set dev v${CONTAINER_IFNAME}du master $BRIDGE
         ip link del dev v${CONTAINER_IFNAME}du
         # Drop traffic from Docker bridge to Weave; it can break subnet isolation
-        run_iptables -t filter -I FORWARD -i $DOCKER_BRIDGE -o $BRIDGE -j DROP
+        if [ ! "$DOCKER_BRIDGE" = "$BRIDGE" ] ; then
+            # Note using -I to insert ahead of Docker's bridge rules
+            run_iptables -t filter -I FORWARD -i $DOCKER_BRIDGE -o $BRIDGE -j DROP
+        fi
         # Work around the situation where there are no rules allowing traffic
         # across our bridge. E.g. ufw
         add_iptables_rule filter FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT