Fix #3106, parse 'not' rules right on destination for port forward + reflection proxy rules