diff --git a/api/client/info.go b/api/client/info.go
index 1e02b10ab1..692bc7482d 100644
--- a/api/client/info.go
+++ b/api/client/info.go
@@ -76,6 +76,12 @@ func (cli *DockerCli) CmdInfo(args ...string) error {
 	if !info.IPv4Forwarding {
 		fmt.Fprintf(cli.err, "WARNING: IPv4 forwarding is disabled.\n")
 	}
+	if !info.BridgeNfIptables {
+		fmt.Fprintf(cli.err, "WARNING: bridge-nf-call-iptables is disabled\n")
+	}
+	if !info.BridgeNfIp6tables {
+		fmt.Fprintf(cli.err, "WARNING: bridge-nf-call-ip6tables is disabled\n")
+	}
 	if info.Labels != nil {
 		fmt.Fprintln(cli.out, "Labels:")
 		for _, attribute := range info.Labels {
diff --git a/api/types/types.go b/api/types/types.go
index 86daa126d1..d54b48bc79 100644
--- a/api/types/types.go
+++ b/api/types/types.go
@@ -153,6 +153,8 @@ type Info struct {
 	CpuCfsPeriod       bool
 	CpuCfsQuota        bool
 	IPv4Forwarding     bool
+	BridgeNfIptables   bool
+	BridgeNfIp6tables  bool
 	Debug              bool
 	NFd                int
 	OomKillDisable     bool
diff --git a/daemon/info.go b/daemon/info.go
index edec5f9ff7..f8994953ab 100644
--- a/daemon/info.go
+++ b/daemon/info.go
@@ -67,6 +67,8 @@ func (daemon *Daemon) SystemInfo() (*types.Info, error) {
 		CpuCfsPeriod:       daemon.SystemConfig().CpuCfsPeriod,
 		CpuCfsQuota:        daemon.SystemConfig().CpuCfsQuota,
 		IPv4Forwarding:     !daemon.SystemConfig().IPv4ForwardingDisabled,
+		BridgeNfIptables:   !daemon.SystemConfig().BridgeNfCallIptablesDisabled,
+		BridgeNfIp6tables:  !daemon.SystemConfig().BridgeNfCallIp6tablesDisabled,
 		Debug:              os.Getenv("DEBUG") != "",
 		NFd:                fileutils.GetTotalUsedFds(),
 		OomKillDisable:     daemon.SystemConfig().OomKillDisable,
diff --git a/pkg/sysinfo/sysinfo.go b/pkg/sysinfo/sysinfo.go
index 5b7eca2458..0ce72572d4 100644
--- a/pkg/sysinfo/sysinfo.go
+++ b/pkg/sysinfo/sysinfo.go
@@ -3,11 +3,13 @@ package sysinfo
 // SysInfo stores information about which features a kernel supports.
 // TODO Windows: Factor out platform specific capabilities.
 type SysInfo struct {
-	MemoryLimit            bool
-	SwapLimit              bool
-	CpuCfsPeriod           bool
-	CpuCfsQuota            bool
-	IPv4ForwardingDisabled bool
-	AppArmor               bool
-	OomKillDisable         bool
+	MemoryLimit                   bool
+	SwapLimit                     bool
+	CpuCfsPeriod                  bool
+	CpuCfsQuota                   bool
+	IPv4ForwardingDisabled        bool
+	AppArmor                      bool
+	OomKillDisable                bool
+	BridgeNfCallIptablesDisabled  bool
+	BridgeNfCallIp6tablesDisabled bool
 }
diff --git a/pkg/sysinfo/sysinfo_linux.go b/pkg/sysinfo/sysinfo_linux.go
index 396ea3b271..b0dd6a499f 100644
--- a/pkg/sysinfo/sysinfo_linux.go
+++ b/pkg/sysinfo/sysinfo_linux.go
@@ -63,6 +63,21 @@ func New(quiet bool) *SysInfo {
 		}
 	}
 
+	// Check if bridge-nf-call-iptables is disabled.
+	if data, err := ioutil.ReadFile("/proc/sys/net/bridge/bridge-nf-call-iptables"); os.IsNotExist(err) {
+		sysInfo.BridgeNfCallIptablesDisabled = true
+	} else {
+		enabled, _ := strconv.Atoi(strings.TrimSpace(string(data)))
+		sysInfo.BridgeNfCallIptablesDisabled = enabled == 0
+	}
+	// Check if bridge-nf-call-ip6tables is disabled.
+	if data, err := ioutil.ReadFile("/proc/sys/net/bridge/bridge-nf-call-ip6tables"); os.IsNotExist(err) {
+		sysInfo.BridgeNfCallIp6tablesDisabled = true
+	} else {
+		enabled, _ := strconv.Atoi(strings.TrimSpace(string(data)))
+		sysInfo.BridgeNfCallIp6tablesDisabled = enabled == 0
+	}
+
 	// Check if AppArmor is supported.
 	if _, err := os.Stat("/sys/kernel/security/apparmor"); os.IsNotExist(err) {
 		sysInfo.AppArmor = false