site/hetz3: Add default MASQ rule for internal network