anchor.diff:  let
   
     cfg = config.networking.nat;
  +
  +  dest = if cfg.externalIP == null then "-j MASQUERADE" else "-j SNAT --to-source ${cfg.externalIP}";
   
   in
   
  
positive.code:         '';
      };
  
      networking.nat.internalIPs = mkOption {
        type = types.listOf types.str;
        example = [ "192.168.1.0/24" ] ;
        description =
          ''
            The IP address ranges for which to perform NAT.  Packets
            coming from these networks and destined for the external
            interface will be rewritten.
          '';
      };
  
  
negative.code: 
          preStart =
            ''
              iptables -t nat -F PREROUTING
              iptables -t nat -F POSTROUTING
              iptables -t nat -X
  
              # We can't match on incoming interface in POSTROUTING, so
              # mark packets coming from the external interfaces.
              ${concatMapStrings (iface: ''
                iptables -t nat -A PREROUTING \
                  -i '${iface}' -j MARK --set-mark 1
              '') cfg.internalInterfaces}
  
              # NAT the marked packets.
              ${optionalString (cfg.internalInterfaces != []) ''
                iptables -t nat -A POSTROUTING -m mark --mark 1 \
                  -o ${cfg.externalInterface} ${dest}
              ''}
  
              # NAT packets coming from the internal IPs.
              ${concatMapStrings (range: ''
                iptables -t nat -A POSTROUTING \
                  -s '${range}' -o ${cfg.externalInterface} ${dest}}
              '') cfg.internalIPs}
  
              echo 1 > /proc/sys/net/ipv4/ip_forward
            '';
  
          postStop =
            ''
              iptables -t nat -F PREROUTING
              iptables -t nat -F POSTROUTING
              iptables -t nat -X
            '';
        };
    };
  