firewall: add support for nat-rules and netifd-proto-originating rules