[backfire] firewall: backport NAT reflection from trunk