iptables: Don't SNAT connections from podCIDR
iptables: Don't SNAT connections from podCIDR

For IPSec and the host firewall, in order to apply kube-proxy's reverse
DNAT we want to send traffic through the tunnel via the stack instead
of doing a redirect call. Such traffic therefore goes from the lxc
device to cilium_host where it is redirected to the tunneling device.

We however SNAT that traffic on its way to cilium_host. We don't need to
apply SNAT there for the pod CIDR as any traffic from the pod CIDR will
either leave directly through the native device (masquerading happening
there) or go through cilium_host and be redirected to the tunnel.

Signed-off-by: Paul Chaignon <a027184a55211cd23e3f3094f1fdc728df5e0500@cilium.io>

cilium/cilium,tgraf/cilium,tgraf/cilium,michi-covalent/cilium,michi-covalent/cilium,tklauser/cilium,cilium/cilium,tgraf/cilium,tgraf/cilium,cilium/cilium,tgraf/cilium,michi-covalent/cilium,tklauser/cilium,tgraf/cilium,tklauser/cilium,cilium/cilium,cilium/cilium,michi-covalent/cilium,tklauser/cilium,tklauser/cilium,michi-covalent/cilium