agent: Masquerade when tunneling is disabled
agent: Masquerade when tunneling is disabled

We currently only add a masquerade rule for endpoint traffic in overlay
mode. Direct routing mode has been expected to use public IP addresses
where masquerading is not required. The majority of users tend to use
private IPs though which makes endpoints unroutable outside of the
internal network.

A possible solution here is to add a masquerade rule which only applies
if:

 - the source address is within local node prefix
 - the destination address is outside of the cluster and service prefix
 - the packet is routed to the outside of the local node

Fixes: #1164

Signed-off-by: Thomas Graf <5f50a84c1fa3bcff146405017f36aec1a10a9e38@cilium.io>

gumpt/cilium,tgraf/cilium,michi-covalent/cilium,michi-covalent/cilium,cilium/cilium,gumpt/cilium,cilium-team/cilium,tklauser/cilium,cilium-team/cilium,gumpt/cilium,gumpt/cilium,eloycoto/cilium,eloycoto/cilium,eloycoto/cilium,cilium/cilium,scanf/cilium,michi-covalent/cilium,eloycoto/cilium,tgraf/cilium,gumpt/cilium,tklauser/cilium,tgraf/cilium,tgraf/cilium,eloycoto/cilium,cilium/cilium,scanf/cilium,michi-covalent/cilium,cilium/cilium,eloycoto/cilium,tklauser/cilium,gumpt/cilium,scanf/cilium,tgraf/cilium,michi-covalent/cilium,scanf/cilium,tgraf/cilium,scanf/cilium,tklauser/cilium,scanf/cilium,gumpt/cilium,tklauser/cilium,cilium/cilium,eloycoto/cilium,scanf/cilium