Fix container -> container networking with MASQUERADE

This is a significant change for such sparse notes.  Why do we need this?  If we do this, we lose pod-to-pod srcip entirely.

We spent a log time figuring out how to get rid of this...