firewall3: fix mark rules for local traffic, fix race condition