enable net.bridge.bridge-nf-call-iptables and net.bridge.bridge-nf-call-arptables.