Docker 1.13 changed how it set up iptables in a way that broke
forwarding.
We previously got away with it because we set the ip_forward sysctl,
which meant that docker wouldn't change the rule. But if we're using an
image that preinstalled docker, docker might have already reconfigured
iptables before we run, and we didn't set it back.
We now set it back.
https://github.com/kubernetes/kubernetes/issues/40182