nat: don't drop packet for expired session