When the sysctl net.bridge.bridge-nf-call-iptables=1 is set, bridged packets will traverse iptables rules. I believe this is the default on modern Linux kernels, but may not be set by default on RHEL/CentOS systems.

The iptables filter table has three chains: INPUT, OUTPUT, FORWARD. In a traditional non-bridge context:

- INPUT means packets entering the host

- OUTPUT means packets leaving the host

- FORWARD means packets being forwarded through the host which are not destined for the host itself.

In the context of a bridge, FORWARD means forwarding packets from one bridge port to another. You can test the simplest case of this with:

  iptables -I FORWARD -j DROP

by adding that rule, two containers on the same host cannot communicate with each other despite the fact that their communication did not require any traditional routing from the host. This is because the bridge traffic also traversed iptables rules.