anchor.diff:          '';
       };
   
  +    networking.nat.extraCommands = mkOption {
  +      type = types.lines;
  +      default = "";
  +      example = "iptables -A INPUT -p icmp -j ACCEPT";
  +      description =
  +        ''
  +          Additional shell commands executed as part of the nat
  +          initialisation script.
  +        '';
  +    };
  +
  +    networking.nat.extraStopCommands = mkOption {
  +      type = types.lines;
  +      default = "";
  +      example = "iptables -D INPUT -p icmp -j ACCEPT || true";
  +      description =
  +        ''
  +          Additional shell commands executed as part of the nat
  +          teardown script.
  +        '';
  +    };
  +
     };
   
   
  
positive.code:         -i ${cfg.externalInterface} -j DNAT \
  	--to-destination ${cfg.dmzHost}
      ''}
  
      # Append our chains to the nat tables
      iptables -w -t nat -A PREROUTING -j nixos-nat-pre
  
negative.code:     iptables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true
      iptables -w -t nat -F nixos-nat-post 2>/dev/null || true
      iptables -w -t nat -X nixos-nat-post 2>/dev/null || true
  
      ${cfg.extraStopCommands}
    '';
  
    setupNat = ''
  