firewall: respect src_dip option for reflection (#18544)