Show DNAT/SNAT --random only for valid protocols.
Remove icmp from MASQUERADE/REDIRECT proto list.