Docker will create an iptables masquerading rule on the host machine when it starts. But old version iptables doesn't have this flag, docker will create duplicate rule after restart.