allow input chain in nat table