add documentation for masqueraded setup
add reminder that we should use ULOG
use correct mac for veth containers
avoid use of --physdev-is-bridged whenever possible

Option physdev-is-bridged only match when both ports are bridged.
But we also want to check IN/OUT rules if only one port is bridged.