Perhaps a fix for the host mode only?

[iMiMx]

https://forums.docker.com/t/solved-incoming-network-traffic-not-forwarding-to-container/43191/6

Then seems to pass GRE for me:

11:42:24.751268 IP 172.17.0.8 > 10.8.11.10: GREv1, call 56583, seq 0, length 41: LCP, Conf-Request (0x01), id 1, length 27
11:42:24.751717 IP 10.8.11.10 > 172.17.0.8: GREv1, call 3840, seq 1, length 36: LCP, Conf-Request (0x01), id 2, length 22
11:42:24.751726 IP 10.8.11.10 > 172.17.0.8: GREv1, call 3840, seq 2, length 41: LCP, Conf-Ack (0x02), id 1, length 27
11:42:24.751892 IP 172.17.0.8 > 10.8.11.10: GREv1, call 56583, seq 1, ack 2, length 28: LCP, Conf-Reject (0x04), id 2, length 10
11:42:24.752141 IP 10.8.11.10 > 172.17.0.8: GREv1, call 3840, seq 3, ack 1, length 36: LCP, Conf-Request (0x01), id 3, length 18
11:42:24.752536 IP 172.17.0.8 > 10.8.11.10: GREv1, call 56583, seq 2, ack 3, length 36: LCP, Conf-Ack (0x02), id 3, length 18
11:42:24.752567 IP 172.17.0.8 > 10.8.11.10: GREv1, call 56583, seq 3, length 24: LCP, Echo-Request (0x09), id 0, length 10
11:42:24.752645 IP 172.17.0.8 > 10.8.11.10: GREv1, call 56583, seq 4, length 48: CHAP, Challenge (0x01), id 87, Value xxxxxx, Name xxxxxx
11:42:24.752903 IP 10.8.11.10 > 172.17.0.8: GREv1, call 3840, seq 4, ack 3, length 28: LCP, Echo-Request (0x09), id 0, length 10
11:42:24.752908 IP 10.8.11.10 > 172.17.0.8: GREv1, call 3840, seq 5, length 24: LCP, Echo-Reply (0x0a), id 0, length 10
11:42:24.752989 IP 172.17.0.8 > 10.8.11.10: GREv1, call 56583, seq 5, ack 4, length 28: LCP, Echo-Reply (0x0a), id 0, length 10

modprobe ip_conntrack_pptp
echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper