shorewall: set IP_FORWARDING to Yes when a NAT rule is added