hybrid: only set nat-rules if there is actually an IPv4 uplink