firewall: fix chain selection logic, option dest must be ignored for notrack targets