anchor.diff:      };
   
       networking.nat.externalInterface = mkOption {
  -      type = types.str;
  +      type = types.nullOr types.str;
  +      default = null;
         example = "eth1";
         description =
           ''
  
positive.code:     # NAT the marked packets.
      ${optionalString (cfg.internalInterfaces != []) ''
        iptables -w -t nat -A nixos-nat-post -m mark --mark 1 \
          -o ${cfg.externalInterface} ${dest}
      ''}
  
      # NAT packets coming from the internal IPs.
      ${concatMapStrings (range: ''
        iptables -w -t nat -A nixos-nat-post \
          -s '${range}' -o ${cfg.externalInterface} ${dest}
      '') cfg.internalIPs}
  
      # NAT from external ports to internal ports.
  
negative.code:     { networking.firewall.extraCommands = mkBefore flushNat; }
      (mkIf config.networking.nat.enable {
  
        assertions = [
          { assertion = (cfg.dmzHost != null)    -> (cfg.externalInterface != null);
            message = "networking.nat.dmzHost requires networking.nat.externalInterface";
          }
          { assertion = (cfg.forwardPorts != []) -> (cfg.externalInterface != null);
            message = "networking.nat.forwardPorts requires networking.nat.externalInterface";
          }
        ];
  
        environment.systemPackages = [ pkgs.iptables ];
  
        boot = {
  