SNAT: fix 1:1 NAT without port hairpinning TCP checksum update