firewall: optimize DNAT rules and skip invalid rules and redirects (#14485)