$ docker network create --opt com.docker.network.bridge.enable_icc=false --internal nicc
a13d820de6c06810fa2797853faba7793bdf135f097c137fddd9c188b67ba1b3
$ 
$ docker run -d --name c1 --network nicc busybox top
fcbb2b8db5a54f64f99c68856a18a626e9fa00af4f3ce63aa1ff8cb875520d3b
$ docker run -d --name c2 --network nicc busybox top
89307983319a362170fb0922ad92444f7f3572b343699151e805d81beabccc7c
$ docker exec c1 ping -c 2 c2
^C
$ sudo iptables -nvL FORWARD
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    2   168 DOCKER-ISOLATION  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0           
    2   168 DROP       all  --  br-a13d820de6c0 br-a13d820de6c0  0.0.0.0/0            0.0.0.0/0           <-- <--
$