Make docker not bypass geoip-shell

[Owen000]

For nginx I am using

    ports:
      - "80:80"
      - "443:443"

I could disable iptables in my docker config but that requires me to manage all of the firewall rules myself.
I was wondering if anyone had a good solution to add geoip-shell to my DOCKER-USERS chain.
This is how the Crowdsec firewall bouncer does it and I believe it is the most elegant way to achieve this goal.

[friendly-bits]

Hi, I'm not a Docker user but I could try to help. Please explain the setup and the problem you are facing.

[Owen000]

I'm running geoip-shell but docker rules get evaluated before other iptables rules, completely bypassing them. Because (my understanding of how this works) geoip-shell uses dynamic rule sets that change every day it makes it a bit more difficult to add to the DOCKER-USER chain which should fix it.
Some reading on the issue:
https://www.reddit.com/r/selfhosted/comments/ocqg1j/psa_docker_bypasses_ufw/
https://docs.docker.com/engine/network/packet-filtering-firewalls/

This isn't an issue with geoip-shell just some weird docker functionality but thought this would be the best place to try to figure it out.

Edit: Looks like it works out of the box and was just the IPs I was using being determined to be US IPs incorrectly

[joomlafun]

I have nginx inside a docker and as you mention in your edit it works fine out of the box yes !