firewall: fix forwarding local subnet traffic