firewall: also establish forward rules when setting up nat reflection, back out early...