update ss-rules

Use DNAT instead of REDIRECT in iptab_r