[package] firewall: don't setup nat reflection if negations are used