Define how to handle NAT64 packets in firewall

[guvenc]

Summary

In the current Firewall API, it is possible to mix IP types for src and destination ip addresses.
This needs to be prevented. A rule should be either ipv4 or ipv6 address family.
(To keep the implementation less complex)
If a rule needs to match both ipv4 and ipv6 ports then two rules need to be created.
This double rule approach will also cover NAT64 packets.