anchor.diff:      let
         vlanIfs = range 1 (length config.virtualisation.vlans);
       in {
  +      environment.systemPackages = [ pkgs.iptables ]; # to debug firewall rules
         virtualisation.vlans = [ 1 2 3 ];
         boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true;
         networking = {
  
positive.code:           $client->waitUntilSucceeds("ip addr show dev eth1 | grep -q '192.168.1'");
            $client->waitUntilSucceeds("ip addr show dev macvlan | grep -q '192.168.1'");
  
            # Print diagnosting information
            $router->succeed("ip addr >&2");
            $client->succeed("ip addr >&2");
  
            # Test macvlan creates routable ips
            $client->waitUntilSucceeds("ping -c 1 192.168.1.1");
  
negative.code:       name = "MACVLAN";
        nodes.router = router;
        nodes.client = { pkgs, ... }: with pkgs.lib; {
          environment.systemPackages = [ pkgs.iptables ]; # to debug firewall rules
          virtualisation.vlans = [ 1 ];
          networking = {
            useNetworkd = networkd;
            firewall.logReversePathDrops = true; # to debug firewall rules
            # reverse path filtering rules for the macvlan interface seem
            # to be incorrect, causing the test to fail. Disable temporarily.
            firewall.checkReversePath = false;
            firewall.allowPing = true;
            useDHCP = true;
            macvlans.macvlan.interface = "eth1";
  