This has been fixed in a redhat errata:RHBA-2015:1289 (Possibly paywall).
In summary - the fix is to move the configuration from sysctl.conf
to modprobe.d/dist.conf
:
Delete the offending lines from /etc/sysctl.conf
sed -i '/net.bridge.bridge-nf-call-/d' /etc/sysctl.conf
And add the behavior to your /etc/modprobe.d/dist.conf
cat <<EOF>>/etc/modprobe.d/dist.conf
# Disable netfilter on bridges when the bridge module is loaded
install bridge /sbin/modprobe --ignore-install bridge && /sbin/sysctl -q -w net.bridge.bridge-nf-call-arptables=0 net.bridge.bridge-nf-call-iptables=0 net.bridge.bridge-nf-call-ip6tables=0
EOF
Which will set the values correctly upon load of the bridge module, or simply update your rpms to versions
module-init-tools-3.9-25.el6
initscripts-9.03.53-1.el6
Both are present by default in RHEL 6.8
If anyone is interested in the history behind this, it's present here with an explanation there.