firewall: prevent ip6tables -t nat rules (#10265)