firewall: introduce SNAT support for redirect sections