The firewall mask should be applied even if the mark is 0, to allow defining a value of e.g. 0/255. Fixes #36973