firewall3: add check_snat() function