fix: scope VPC SNAT rule to exclude locally-generated packets (#13942)

On a VPC with public IPs from more than one range/VLAN, the virtual router
installs an unscoped source NAT rule on every public interface using the
single VPC source NAT address. Because the rule has no source match, it
also rewrites traffic the router itself originates, so the VR cannot emit
packets with the correct source address from any public interface other
than the source-NAT one.

Fix: add `-m addrtype ! --src-type LOCAL` to the elif SNAT rule so it only
matches forwarded (guest) traffic, not locally-generated packets.

Closes: #13942

Author: waterWang

systemvm/debian/opt/cloud/bin/cs/CsAddress.py

@@ -889,7 +889,7 @@ def post_config_change(self, method):
                     ["nat", "", "-A POSTROUTING -j SNAT -o %s --to-source %s" % (self.dev, self.address['public_ip'])])
             elif cmdline.get_source_nat_ip() and not self.is_private_gateway():
                 self.fw.append(
-                    ["nat", "", "-A POSTROUTING -j SNAT -o %s --to-source %s" % (self.dev, cmdline.get_source_nat_ip())])
+                    ["nat", "", "-A POSTROUTING -m addrtype ! --src-type LOCAL -j SNAT -o %s --to-source %s" % (self.dev, cmdline.get_source_nat_ip())])
 
     def list(self):
         self.iplist = {}