gluon-firewall: enable conntrack on WAN

Otherwise, the state match doesn't work, not allowing replies to outgoing
packets to get in.