firewall: add option to disable NAT reflection