enable hairpin mode on virtual interface bridge port

This is to support being able to DNAT/MASQ traffic from a container back into itself (dotcloud/docker#4442)

See subsequent pull request on docker project for details.
It would be possible to limp along without it. I see 2 potential avenues.

1. If we remove the proxy, hairpin connections would simply fail.
2. If we keep the proxy, we could not add the iptables rule to DNAT traffic, this would cause the connection to hit the proxy which would route it back in.