firewall-utils: init_forwarding to require source subnet