Docker docker - compor e desabilitar iptables

Question

Meu docker-compose.yml

version: '3'
services:
  test:
    restart: always
    image: bind:utility
    networks:
      front:
        ipv4_address: 172.99.0.2

networks:
    front:
      driver: bridge
      driver_opts:
         com.docker.network.bridge.enable_ip_masquerade: "false"
      ipam:
         driver: default
         config:
         -
            subnet: 172.99.0.0/24

A saída da rede do docker inspeciona webserver_front

[
    {
        "Name": "webserver_front",
        "Id": "7d32e0e7f0614b6ed39cf2cc3920aa88613153d4903c0edbb2e021e02827c9e7",
        "Created": "2018-03-27T16:23:15.139906912Z",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.99.0.0/24"
                }
            ]
        },
        "Internal": false,
        "Attachable": true,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "d4188bfa910f8917f0d748530397e39dca877d80ea69521bbda002704ef28d1a": {
                "Name": "webserver_test_1",
                "EndpointID": "adf542708d487d62a889622b21858b60613701c41a3cb389290b0a64b84ab27d",
                "MacAddress": "02:42:ac:63:00:02",
                "IPv4Address": "172.99.0.2/24",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.bridge.enable_ip_masquerade": "false"
        },
        "Labels": {
            "com.docker.compose.network": "front",
            "com.docker.compose.project": "webserver"
        }
    }
]

O que eu estou tentando fazer é criar uma rede interna, onde eu estou 100% responsável pelo iptables. mas de alguma forma eu não posso para a vida de mim conseguir que isso funcione ..

Ainda estou recebendo

A POSTROUTING -s 172.99.0.2/32 -d 172.99.0.2/32 -p tcp -m tcp --dport 10000 -j MASQUERADE
-A POSTROUTING -s 172.99.0.2/32 -d 172.99.0.2/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -s 172.99.0.2/32 -d 172.99.0.2/32 -p tcp -m tcp --dport 53 -j MASQUERADE
-A POSTROUTING -s 172.99.0.2/32 -d 172.99.0.2/32 -p udp -m udp --dport 53 -j MASQUERADE