the 'map-e-portset' option is only valid with nat rules