nat: correct detection of icmp bypass presence