firewall: add support for "local" port forwards which target an internal address...