eth to wifi bridge and iptables

[Hu]

Your DOCKER-ISOLATION chain appears not to isolate much anymore. According to your most recent output, it is now extremely permissive (unless, as before, the use of iptables instead of iptables-save is hiding important qualifiers).

[paulusbrand]

I don't know, here the output of iptables-save:

[Hu]

That's much more readable. Thank you.

As hinted at by the terse output, and explicitly confirmed here, your DOCKER-ISOLATION chain now ACCEPTs all traffic. Since FORWARD passes all traffic to it, your FORWARD policy of DROP is irrelevant. Every forwarding decision is ACCEPTed by DOCKER-ISOLATION before more specific rules can act on it. This is why your networking works again. You can simplify this by removing all rules from the FORWARD chain and changing its policy to ACCEPT. You will get the same effect with less work.