firewall: small improvements in nat reflection