Dealing with Docker's networking and it's slightly protracted and abstracted way of doing things shoved me back to iptables. I'd got quite comfortable with firewall-d for basic rulesets but the lack of easy and quick introspection soon bugged me.