Docker: user defined networks cannot access Internet after a reboot

Unraid 6.11.5.

Alright, this one I struggled with for a couple weeks, I guess. Tried all kinds of different configurations but seems like the problem was just with iptables.

Story so far: I'm using custom Docker bridge with disabled icc and masquerading, since all of this will be taken care of by my router (OPNsense in VM). In order for Docker containers to access internet, I have to use the router as a gateway, which is set as a default one in the Unraid host (thanks, libvirt).

Now the interesting part. If I use the predefined `docker0` network (btw maybe you should add a possibility to remove it, since it's not useful for everyone), container can reach out to the internet just fine. Same goes for any created Docker network (bridge), but it only lasts until Unraid is rebooted! After a reboot Internet is unreachable from a container (`Destination Port Unreachable`).

The problem lies in the order of the iptables rules in the `FORWARD` chain:

root@unraid:~# iptables -L -v -n
Chain INPUT (policy ACCEPT 1933 packets, 206K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 4704  476K LIBVIRT_INP  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 5415 3513K DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 5415 3513K DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0                    
 3972 4288K ACCEPT     all  --  *      docker5  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      docker5  0.0.0.0/0            0.0.0.0/0           
 2996  226K ACCEPT     all  --  docker5 !docker5  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0           
  278 19226 LIBVIRT_FWX  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  278 19226 LIBVIRT_FWI  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LIBVIRT_FWO  all  --  *      *       0.0.0.0/0            0.0.0.0/0                     
    0     0 ACCEPT     all  --  *      docker4  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      docker4  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  docker4 !docker4  0.0.0.0/0            0.0.0.0/0           
    0     0 WIREGUARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  docker4 docker4  0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  docker5 docker5  0.0.0.0/0            0.0.0.0/0           

Here `docker5` is a freshly created bridge, and `docker4` was created before the reboot. The only difference is that they are separated by the libvirt rules.

The manual solution: if I move the three `docker4` rules above the `LIBVIRT_FWX` rule manually, to mimic a scenario when this network was created via console just now, this network starts working properly.

It would be great if you add a fix, so that the custom Docker network rules are put before the libvirt rules.