net-firewall/ipsec-tools: add nat use flag