Move per-container forward rules to DOCKER chain

Closes #6034

Docker-DCO-1.1-Signed-off-by: Ian Bishop <ianbishop@pace7.com> (github: porjo)
Here it would be best to use ``iptables.Insert`` instead, so that rules are inserted at top of the chain, see [my comment](https://github.com/docker/docker/issues/6034#issuecomment-58651484)