netfilter: nat: cope with negative port range