applications/luci-firewall: support NOTRACK rules