[package] firwall: fix nat reflection for zones covering multiple networks