Don't masquerade traffic inbound from the internet

Our MASQUERADE rule was too general.  Limit it to internally-sourced
traffic.