nat: ICMP handling fixes