[package] firewall: allow redirecting only destination port (#7197)