title: iptables not working on macvlan traffic in container
body: <p>I have a host with one interface <code>eth0</code>, IP <code>10.0.10.10/24</code>. I start up docker, add a container, no network. I then create a macvlan device on <code>eth0</code>, give it IP <code>10.0.10.20/24</code>, and put it in the container.</p>
  
  <p>Both the host and the container now have full network access.</p>
  
  <p>I then create an iptables rule on the host to drop all traffic to or from the container's IP <code>10.0.10.20</code>. The rules do not work, and traffic gets through. </p>
  
  <p>Of course, if I do it from within the container (either <code>ip netns exec $PID iptables ...</code> or by giving the container <code>NET_ADMIN</code> capabilities), it works.</p>
  
  <p>Should the iptables rules of the underlying host not filter the traffic?</p>