fix masq

files/bridge-post-scripts/post-up.sh.j2

@@ -57,7 +57,7 @@ handle_gateway {{gateway.id}} {{gateway.address}} {% if gateway.mac is defined a
 
 {% if br.masq is defined and br.masq %}
 # Masquerade
-iptables -t nat -A POSTROUTING -o "$BRIDGE_NAME" -m set --match-set localnet src -j MASQUERADE
+iptables -t nat -A POSTROUTING -o "$BRIDGE_NAME" -m set --match-set localnet src -m set ! --match-set localnet dst -j MASQUERADE
 {% endif %}
 
 {% if br.dhcpv6Client is defined and br.dhcpv6Client %}

files/bridge-post-scripts/pre-down.sh.j2

@@ -46,6 +46,7 @@ handle_gateway {{gateway.id}} {{gateway.address}} {% if gateway.mac is defined a
 # Masquerade
 iptables -t nat -D POSTROUTING -o "$BRIDGE_NAME" -j MASQUERADE
 iptables -t nat -D POSTROUTING -o "$BRIDGE_NAME" -m set --match-set localnet src -j MASQUERADE
+iptables -t nat -D POSTROUTING -o "$BRIDGE_NAME" -m set --match-set localnet src -m set ! --match-set localnet dst -j MASQUERADE
 {% endif %}
 
 {% if br.down is defined and br.down %}