zones: properly handle multiple masq_src / masq_dest negations (FS#248)