[package] firewall: add option to disable NAT reflection