Rootless container internet connectivity not working when iptables disabled

Description

I have noticed that any sort of internet request (ping/curl/dig) doesn't work inside containers when I set iptables to false in ~/.config/docker/daemon.json (rootless daemon config).
When I start the docker user service it used to log "skipping firewalld management for rootless mode", so I thought that the iptables setting is skipped anyway for rootless docker and I disabled it. After all the rootless docker daemon doesn't have the required root access to modify iptables rules and there aren't any changes when I checked with sudo iptables -L.

I think that somewhere in the code some critical internet connectivity thing depends on the state of the iptables setting even if it shouldn't.

Reproduce

1. Setup rootless docker
2. Set iptables to false in ~/.config/docker/daemon.json:

   {
     "iptables": false
   }
   

3. Start a docker container and run something like wget:

   docker run --rm alpine wget https://google.com
   

4. Internet connectivity isn't working and wget outputs something like:

   wget: bad address 'google.com'
   

5. Remove the iptables setting from the daemon.json file and try again, wget should work now.

Expected behavior

Internet connectivity should not be affected by the iptables setting in rootless mode.

docker version

Client: Docker Engine - Community
 Version:           25.0.5
 API version:       1.44
 Go version:        go1.21.8
 Git commit:        5dc9bcc
 Built:             Tue Mar 19 15:05:34 2024
 OS/Arch:           linux/amd64
 Context:           rootless

Server: Docker Engine - Community
 Engine:
  Version:          25.0.5
  API version:      1.44 (minimum version 1.24)
  Go version:       go1.21.8
  Git commit:       e63daec
  Built:            Tue Mar 19 15:05:34 2024
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.28
  GitCommit:        ae07eda36dd25f8a1b98dfbf587313b99c0190bb
 runc:
  Version:          1.1.12
  GitCommit:        v1.1.12-0-g51d5e94
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
 rootlesskit:
  Version:          2.0.2
  ApiVersion:       1.1.1
  NetworkDriver:    slirp4netns
  PortDriver:       builtin
  StateDir:         /run/user/1000/dockerd-rootless
 slirp4netns:
  Version:          1.2.0
  GitCommit:        656041d45cfca7a4176f6b7eed9e4fe6c11e8383

docker info

Client: Docker Engine - Community
 Version:    25.0.5
 Context:    rootless
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.13.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.25.0
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 1
 Server Version: 25.0.5
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: false
  userxattr: true
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: ae07eda36dd25f8a1b98dfbf587313b99c0190bb
 runc version: v1.1.12-0-g51d5e94
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  rootless
  cgroupns
 Kernel Version: 6.1.0-18-amd64
 Operating System: Debian GNU/Linux 12 (bookworm)
 OSType: linux
 Architecture: x86_64
 CPUs: 6
 Total Memory: 15.62GiB
 Name: ordontest
 ID: b5969804-5e9a-42df-a2f7-20690bdbdfe0
 Docker Root Dir: /home/jonas/.local/share/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

Additional Info

No response

Reproduce the failure with a rootless Docker daemon and iptables: false in ~/.config/docker/daemon.json, then compare it after removing that setting. Trace the rootless networking and iptables-setting handling; done means container DNS and internet requests work with iptables disabled in rootless mode.