firewall: fix port range quirk in previous commit