nat: fix port number selection