madhuvishy@tools-clushmaster-01:~$ clush -w @paws-worker -b 'sudo iptables -L FORWARD'
---------------
tools-paws-worker-[1002-1003,1005-1007,1010,1013,1016].tools.eqiad.wmflabs (8)
---------------
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
---------------
tools-paws-worker-1001.tools.eqiad.wmflabs
---------------
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
---------------
tools-paws-worker-1017.tools.eqiad.wmflabs
---------------
Chain FORWARD (policy DROP)
target     prot opt source               destination
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
---------------
tools-paws-worker-1019.tools.eqiad.wmflabs
---------------
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DOCKER-ISOLATION  all  --  anywhere             anywhere
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
DOCKER-USER  all  --  anywhere             anywhere