firewall: optimize DNAT rules and skip invalid rules and redirects (#14485)

	- instead of writing one (or more) ACCEPT rules in the filter table
	  for each redirect install a global ctstate DNAT accept rule per zone

	- discard rules and redirects which have invalid options set instead
	  of silently skipping the invalid values

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38849 3c298f89-4303-0410-b956-a3cf2f4a3e73
[omap]: make default packages selected for real

Signed-off-by: Imre Kaloz <kaloz@openwrt.org>



git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38850 3c298f89-4303-0410-b956-a3cf2f4a3e73