anchor.diff:            ];
   
           router =
  -          { config, pkgs, ... }:
  -          lib.mkMerge [
  -            { virtualisation.vlans = [ 2 1 ];
  -              networking.firewall.enable = withFirewall;
  -              networking.firewall.allowPing = true;
  -              networking.nat.enable = true;
  -              networking.nat.internalIPs = [ "192.168.1.0/24" ];
  -              networking.nat.externalInterface = "eth1";
  -            }
  -            (lib.optionalAttrs withConntrackHelpers {
  -              networking.firewall.connectionTrackingModules = [ "ftp" ];
  -              networking.firewall.autoLoadConntrackHelpers = true;
  -            })
  -          ];
  +        { config, pkgs, ... }: lib.mkMerge [
  +          routerBase
  +          { networking.nat.enable = true; }
  +        ];
  +
  +        routerDummyNoNat =
  +        { config, pkgs, ... }: lib.mkMerge [
  +          routerBase
  +          { networking.nat.enable = false; }
  +        ];
   
           server =
             { config, pkgs, ... }:
  
positive.code: import ./make-test.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false, ... }:
    let
      unit = if withFirewall then "firewall" else "nat";
    in
    {
      name = "nat" + (if withFirewall then "WithFirewall" else "Standalone")
  
negative.code:       };
  
      testScript =
        { nodes, ... }: let
          routerDummyNoNatClosure = nodes.routerDummyNoNat.config.system.build.toplevel;
          routerClosure = nodes.router.config.system.build.toplevel;
        in ''
          $client->start;
          $router->start;
          $server->start;
  
          # The router should have access to the server.
          $server->waitForUnit("network.target");
  