[opensuse] iptables: limiting NAT