agent: Move iptables rules to clear KUBE-MARK-MASQ to mangle table
agent: Move iptables rules to clear KUBE-MARK-MASQ to mangle table

Kubernetes 1.9 has introduced new iptables rules a part of the FORWARD chain in
the filter table:

  -m mark --mark 0x4000/0x4000 -j ACCEPT
  -s 10.233.64.0/18 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  -d 10.233.64.0/18 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Because it is impossible to guarantee the order of iptables rules with multiple
writers, the following rule required by Cilium did no longer take any effect

  -o cilium_host -j MARK --set-xmark 0x0/0x4000

The rule is required to ensure that Cilium can choose the source IP to
masquerade to.

By moving the above Cilium rule to the mangle table in POSTROUTING, it is
guaranteed to run before the kube-proxy rules residing in the filter table.

This also makes NodePort services available from local processes.

Fixes: #2505
Fixes: #2495

Signed-off-by: Thomas Graf <5f50a84c1fa3bcff146405017f36aec1a10a9e38@cilium.io>

scanf/cilium,tklauser/cilium,scanf/cilium,tklauser/cilium,michi-covalent/cilium,eloycoto/cilium,cilium/cilium,tgraf/cilium,eloycoto/cilium,cilium/cilium,cilium-team/cilium,tgraf/cilium,eloycoto/cilium,michi-covalent/cilium,tklauser/cilium,michi-covalent/cilium,tgraf/cilium,eloycoto/cilium,cilium/cilium,eloycoto/cilium,scanf/cilium,scanf/cilium,tgraf/cilium,eloycoto/cilium,michi-covalent/cilium,tklauser/cilium,scanf/cilium,cilium/cilium,tgraf/cilium,tklauser/cilium,eloycoto/cilium,michi-covalent/cilium,tgraf/cilium,cilium/cilium,cilium-team/cilium,scanf/cilium,scanf/cilium