Ban does not seem to work with docker

Hello, Thanks for the hard work on this, looks very promising.

I'm having issue when using reaction on a host where docker containers are exposed to the outside. I have a traefik instance running inside a container, with ports 443 and 80 opened, meaning docker adds its own rules to iptables.

I tried to trigger a ban in order to test the filters I wrote, and while the filter itself work, the IP is not really banned. It is correctly added to iptables, but I guess the iptables rule is not triggered because it is accepted by a docker rule before it reach the reaction rule. I don't know much about iptables, do you have any idea how could I make this work?

Here is the output of sudo ip6tables -L -v -n

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  679  114K reaction   0    --  *      *       ::/0                 ::/0                

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
36650   37M DOCKER-ISOLATION-STAGE-1  0    --  *      *       ::/0                 ::/0                
18968 2115K ACCEPT     0    --  *      br-4c2cb4d79c9d  ::/0                 ::/0                 ctstate RELATED,ESTABLISHED
  427 33000 DOCKER     0    --  *      br-4c2cb4d79c9d  ::/0                 ::/0                
17255   35M ACCEPT     0    --  br-4c2cb4d79c9d !br-4c2cb4d79c9d  ::/0                 ::/0                
   79  5128 ACCEPT     0    --  br-4c2cb4d79c9d br-4c2cb4d79c9d  ::/0                 ::/0                
    0     0 ACCEPT     0    --  *      br-807b7c1e24db  ::/0                 ::/0                 ctstate RELATED,ESTABLISHED
    0     0 DOCKER     0    --  *      br-807b7c1e24db  ::/0                 ::/0                
    0     0 ACCEPT     0    --  br-807b7c1e24db !br-807b7c1e24db  ::/0                 ::/0                
    0     0 ACCEPT     0    --  br-807b7c1e24db br-807b7c1e24db  ::/0                 ::/0                

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     6    --  !br-4c2cb4d79c9d br-4c2cb4d79c9d  ::/0                 fd9a:78e:85ba::3     tcp dpt:51413
    0     0 ACCEPT     17   --  !br-4c2cb4d79c9d br-4c2cb4d79c9d  ::/0                 fd9a:78e:85ba::3     udp dpt:51413
  156 12512 ACCEPT     6    --  !br-4c2cb4d79c9d br-4c2cb4d79c9d  ::/0                 fd9a:78e:85ba::3     tcp dpt:443
   13  1040 ACCEPT     6    --  !br-4c2cb4d79c9d br-4c2cb4d79c9d  ::/0                 fd9a:78e:85ba::3     tcp dpt:80

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DOCKER-ISOLATION-STAGE-2  0    --  br-805c99fe5b9f !br-805c99fe5b9f  ::/0                 ::/0                
    0     0 DOCKER-ISOLATION-STAGE-2  0    --  br-f23432d0d9dd !br-f23432d0d9dd  ::/0                 ::/0                
    0     0 DOCKER-ISOLATION-STAGE-2  0    --  docker0 !docker0  ::/0                 ::/0                
    0     0 DOCKER-ISOLATION-STAGE-2  0    --  br-76f14e4ae712 !br-76f14e4ae712  ::/0                 ::/0                
17255   35M DOCKER-ISOLATION-STAGE-2  0    --  br-4c2cb4d79c9d !br-4c2cb4d79c9d  ::/0                 ::/0                
    0     0 DOCKER-ISOLATION-STAGE-2  0    --  br-058ae15ff619 !br-058ae15ff619  ::/0                 ::/0                
    0     0 DOCKER-ISOLATION-STAGE-2  0    --  br-857d5bb4b42d !br-857d5bb4b42d  ::/0                 ::/0                
    0     0 DOCKER-ISOLATION-STAGE-2  0    --  br-807b7c1e24db !br-807b7c1e24db  ::/0                 ::/0                
36650   37M RETURN     0    --  *      *       ::/0                 ::/0                

Chain DOCKER-ISOLATION-STAGE-2 (8 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       0    --  *      br-805c99fe5b9f  ::/0                 ::/0                
    0     0 DROP       0    --  *      br-f23432d0d9dd  ::/0                 ::/0                
    0     0 DROP       0    --  *      docker0  ::/0                 ::/0                
    0     0 DROP       0    --  *      br-76f14e4ae712  ::/0                 ::/0                
    0     0 DROP       0    --  *      br-4c2cb4d79c9d  ::/0                 ::/0                
    0     0 DROP       0    --  *      br-058ae15ff619  ::/0                 ::/0                
    0     0 DROP       0    --  *      br-857d5bb4b42d  ::/0                 ::/0                
    0     0 DROP       0    --  *      br-807b7c1e24db  ::/0                 ::/0                
17255   35M RETURN     0    --  *      *       ::/0                 ::/0                

Chain reaction (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       0    --  *      *       2a02:8440:d124:692f:0:25:ea27:5f01  ::/0

As you can see the banned IP is correctly added in the reaction chain, but no packets reach it.

Would the proper way to filter it is to add a reaction rule at FORWARD, as well as the current INPUT one chain when starting reaction ? Like iptables(['-I', 'FORWARD', '-p', 'all', '-j', 'reaction'] ?

Thank you