anchor.diff:          -i ${cfg.externalInterface} -j DNAT \
   	--to-destination ${cfg.dmzHost}
       ''}
  +
  +    ${cfg.extraCommands}
   
       # Append our chains to the nat tables
       iptables -w -t nat -A PREROUTING -j nixos-nat-pre
  
positive.code:         '';
      };
  
    };
  
  
  
negative.code:     iptables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true
      iptables -w -t nat -F nixos-nat-post 2>/dev/null || true
      iptables -w -t nat -X nixos-nat-post 2>/dev/null || true
  
      ${cfg.extraStopCommands}
    '';
  
    setupNat = ''
  