Don't masquerade traffic inbound from the internet

Our MASQUERADE rule was too general.  Limit it to internally-sourced
traffic.
restore NAT to hosts without floatips
small flake8 fix
flake8
fix one of the tests for our MASQ fix
fix some further tests
finally fix the final tests with the MASQ fix
MARK all traffic inbound from the internet

We use this MARK to skip the entire SNAT chain.  We never EVER want to
NAT or MASQ anything entering eth1.
Merge pull request #103 from fzylogic/master

Don't masquerade traffic inbound from the internet