Fix per-jail NAT once and for all