nat: allow ACCEPT-target to explicitely disable NAT