anchor.diff:    testScript =
       ''
         startAll;
  +
  +      # Enable NAT on the router and start miniupnpd.
  +      $router->mustSucceed(
  +          "iptables -t nat -F",
  +          "iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -d 192.168.2.0/24 -j ACCEPT",
  +          "iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -j SNAT --to-source 192.168.1.3", # !!! ugly
  +          "iptables -t nat -N MINIUPNPD",
  +          "iptables -t nat -A PREROUTING -i eth1 -j MINIUPNPD",
  +          "echo 1 > /proc/sys/net/ipv4/ip_forward",
  +          "miniupnpd -f ${miniupnpdConf}"
  +      );
   
         # Create the torrent.
         $tracker->mustSucceed("mkdir /tmp/data");
  
positive.code:           services.httpd.documentRoot = "/tmp";
          };
  
        client = 
          { config, pkgs, ... }:
          { environment.systemPackages = [ pkgs.transmission ];
          };
  
negative.code: # This test runs a Bittorrent tracker on one machine, and verifies
  # that two client machines can download the torrent using
  # `transmission'.  The first client (behind a NAT router) downloads
  # from the initial seeder running on the tracker.  Then we kill the
  # initial seeder.  The second client downloads from the first client,
  # which only works if the first client successfully uses the UPnP-IGD
  # protocol to poke a hole in the NAT.
  
  { pkgs, ... }:
  
  let
  
    # Some random file to serve.
    file = pkgs.nixUnstable.src;
  
    miniupnpdConf = pkgs.writeText "miniupnpd.conf"
      ''
        ext_ifname=eth1
        listening_ip=192.168.2.3/24
        allow 1024-65535 192.168.2.0/24 1024-65535
      '';
    
  in
  
  