firewall-defaults: don't set MASQUERADE rule (NAT) for ipip tunnel
ffwizard-berlin: fix private_ap fields