firewall: extend nat reflection support