firwall: fix nat reflection for zones covering multiple networks