shorewall: better port validation
shorewall: allow multiple dst ports