Container net reachable check should be more robust

"4.2.2.1" is an exact internet IP, it can not be reached if behind a http proxy environment, for "ping" packet will not use the http proxy. If container can reach the DEA's gateway, that also mean `net out` is OK.