Containers attached to the default bridge network work as expected. The following command should spin up portainer correctly.

docker run -d -p 8000:8000 -p 9000:9000 --name=portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock portainer/portainer-ce

However, attaching it to a user-defined bridge network doesn't work correctly yet. Steps to reproduce:

docker network create my-net
docker run -d -p 8000:8000 -p 9000:9000 --name=portainer --network my-net --restart=always -v /var/run/docker.sock:/var/run/docker.sock portainer/portainer-ce

Docker provides extensive documentation about bridge networking. Especially the section Enable forwarding from Docker containers to the outside world seems relevant.

1. Configure the Linux kernel to allow IP forwarding.
   sysctl net.ipv4.conf.all.forwarding=1
2. Change the policy for the iptables FORWARD policy from DROP to ACCEPT.
   sudo iptables -P FORWARD ACCEPT

Step 2 has been addressed in version v1.2.0 of the script. The first step doesn't work on Synology DSM yet.