Add a ICMP reply rule for service VIP

Ping on VIP has been behaving inconsistently depending on if a task
for a service is local or remote.

With this fix, the ICMP echo-request packets to service VIP are replied
to by the NAT rule to self

Signed-off-by: Madhu Venugopal <madhu@docker.com>

libnetwork/service_linux.go

@@ -654,6 +654,9 @@ func fwMarker() {
 	rule := strings.Fields(fmt.Sprintf("-t mangle %s OUTPUT -d %s/32 -j MARK --set-mark %d", addDelOpt, vip, fwMark))
 	rules = append(rules, rule)
 
+	rule = strings.Fields(fmt.Sprintf("-t nat %s OUTPUT -p icmp --icmp echo-request -d %s -j DNAT --to 127.0.0.1", addDelOpt, vip))
+	rules = append(rules, rule)
+
 	for _, rule := range rules {
 		if err := iptables.RawCombinedOutputNative(rule...); err != nil {
 			logrus.Errorf("setting up rule failed, %v: %v", rule, err)