nat: fix ICMP checksum validation