kernel/v2: validate forwarded ports [GH-3187]