code: func arrangeIngressFilterRule() {
  	if iptables.ExistChain(ingressChain, iptables.Filter) {
  		if iptables.Exists(iptables.Filter, "FORWARD", "-j", ingressChain) {
  			if err := iptables.RawCombinedOutput("-D", "FORWARD", "-j", ingressChain); err != nil {
  				logrus.Warnf("failed to delete jump rule to ingressChain in filter table: %v", err)
  			}
  		}
  		if err := iptables.RawCombinedOutput("-I", "FORWARD", "-j", ingressChain); err != nil {
  			logrus.Warnf("failed to add jump rule to ingressChain in filter table: %v", err)
  		}
  	}
  }
docs: // In the filter table FORWARD chain the first rule should be to jump to
  // DOCKER-USER so the user is able to filter packet first.
  // The second rule should be jump to INGRESS-CHAIN.
  // This chain has the rules to allow access to the published ports for swarm tasks
  // from local bridge networks and docker_gwbridge (ie:taks on other swarm networks)