Chain INPUT (policy ACCEPT 39M packets, 16G bytes)
 pkts bytes target     prot opt in     out     source               destination         
  39M   16G ts-input   0    --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
3087K 1712M DOCKER-USER  0    --  *      *       0.0.0.0/0            0.0.0.0/0           
4434K 2439M DOCKER-ISOLATION-STAGE-1  0    --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     0    --  *      docker_gwbridge  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     0    --  *      docker_gwbridge  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     0    --  docker_gwbridge !docker_gwbridge  0.0.0.0/0            0.0.0.0/0           
 415K   70M ACCEPT     0    --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
10760  646K DOCKER     0    --  *      docker0  0.0.0.0/0            0.0.0.0/0           
 385K  378M ACCEPT     0    --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     0    --  docker0 docker0  0.0.0.0/0            0.0.0.0/0           
1795K 1819M ACCEPT     0    --  *      br-a8c08ace4629  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
   51  3060 DOCKER     0    --  *      br-a8c08ace4629  0.0.0.0/0            0.0.0.0/0           
1829K  172M ACCEPT     0    --  br-a8c08ace4629 !br-a8c08ace4629  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     0    --  br-a8c08ace4629 br-a8c08ace4629  0.0.0.0/0            0.0.0.0/0           
    0     0 ts-forward  0    --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       0    --  docker_gwbridge docker_gwbridge  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain DOCKER (3 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     6    --  !br-a8c08ace4629 br-a8c08ace4629  0.0.0.0/0            172.18.0.2           tcp dpt:3001
   51  3060 ACCEPT     6    --  !br-a8c08ace4629 br-a8c08ace4629  0.0.0.0/0            172.18.0.3           tcp dpt:8443
    0     0 ACCEPT     6    --  !br-a8c08ace4629 br-a8c08ace4629  0.0.0.0/0            172.18.0.4           tcp dpt:8080
10760  646K ACCEPT     6    --  !docker0 docker0  0.0.0.0/0            172.17.0.2           tcp dpt:9001

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DOCKER-ISOLATION-STAGE-2  0    --  docker_gwbridge !docker_gwbridge  0.0.0.0/0            0.0.0.0/0           
 385K  378M DOCKER-ISOLATION-STAGE-2  0    --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0           
1829K  172M DOCKER-ISOLATION-STAGE-2  0    --  br-a8c08ace4629 !br-a8c08ace4629  0.0.0.0/0            0.0.0.0/0           
4434K 2439M RETURN     0    --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain DOCKER-ISOLATION-STAGE-2 (3 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       0    --  *      docker_gwbridge  0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       0    --  *      docker0  0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       0    --  *      br-a8c08ace4629  0.0.0.0/0            0.0.0.0/0           
2214K  549M RETURN     0    --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination         
4434K 2439M RETURN     0    --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ts-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MARK       0    --  tailscale0 *       0.0.0.0/0            0.0.0.0/0            MARK xset 0x40000/0xff0000
    0     0 ACCEPT     0    --  *      *       0.0.0.0/0            0.0.0.0/0            mark match 0x40000/0xff0000
    0     0 DROP       0    --  *      tailscale0  100.64.0.0/10        0.0.0.0/0           
    0     0 ACCEPT     0    --  *      tailscale0  0.0.0.0/0            0.0.0.0/0           

Chain ts-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     0    --  lo     *       100.118.220.45       0.0.0.0/0           
    0     0 RETURN     0    --  !tailscale0 *       100.115.92.0/23      0.0.0.0/0           
   29  4919 DROP       0    --  !tailscale0 *       100.64.0.0/10        0.0.0.0/0           
 120K   64M ACCEPT     0    --  tailscale0 *       0.0.0.0/0            0.0.0.0/0           
76135   29M ACCEPT     17   --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:39440
