anchor.diff:      ${cfg.extraStopCommands}
     '';
   
  -  setupNat = ''
  -    ${helpers}
  -    # Create subchain where we store rules
  -    ip46tables -w -t nat -N nixos-nat-pre
  -    ip46tables -w -t nat -N nixos-nat-post
  -    ip46tables -w -t nat -N nixos-nat-out
  -
  +  mkSetupNat = { iptables, dest, internalIPs, forwardPorts }: ''
       # We can't match on incoming interface in POSTROUTING, so
       # mark packets coming from the internal interfaces.
       ${concatMapStrings (iface: ''
  -      iptables -w -t nat -A nixos-nat-pre \
  +      ${iptables} -w -t nat -A nixos-nat-pre \
           -i '${iface}' -j MARK --set-mark 1
       '') cfg.internalInterfaces}
   
       # NAT the marked packets.
       ${optionalString (cfg.internalInterfaces != []) ''
  -      iptables -w -t nat -A nixos-nat-post -m mark --mark 1 \
  +      ${iptables} -w -t nat -A nixos-nat-post -m mark --mark 1 \
           ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest}
       ''}
   
       # NAT packets coming from the internal IPs.
       ${concatMapStrings (range: ''
  -      iptables -w -t nat -A nixos-nat-post \
  +      ${iptables} -w -t nat -A nixos-nat-post \
           -s '${range}' ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest}
  -    '') cfg.internalIPs}
  +    '') internalIPs}
   
       # NAT from external ports to internal ports.
       ${concatMapStrings (fwd: ''
  -      iptables -w -t nat -A nixos-nat-pre \
  +      ${iptables} -w -t nat -A nixos-nat-pre \
           -i ${toString cfg.externalInterface} -p ${fwd.proto} \
           --dport ${builtins.toString fwd.sourcePort} \
           -j DNAT --to-destination ${fwd.destination}
   
         ${concatMapStrings (loopbackip:
           let
  -          m                = builtins.match "([0-9.]+):([0-9-]+)" fwd.destination;
  -          destinationIP    = if (m == null) then throw "bad ip:ports `${fwd.destination}'" else elemAt m 0;
  -          destinationPorts = if (m == null) then throw "bad ip:ports `${fwd.destination}'" else builtins.replaceStrings ["-"] [":"] (elemAt m 1);
  +          matchIP          = if isIPv6 fwd.destination then "[[]([0-9a-fA-F:]+)[]]" else "([0-9.]+)";
  +          m                = builtins.match "${matchIP}:([0-9-]+)" fwd.destination;
  +          destinationIP    = if m == null then throw "bad ip:ports `${fwd.destination}'" else elemAt m 0;
  +          destinationPorts = if m == null then throw "bad ip:ports `${fwd.destination}'" else builtins.replaceStrings ["-"] [":"] (elemAt m 1);
           in ''
             # Allow connections to ${loopbackip}:${toString fwd.sourcePort} from the host itself
  -          iptables -w -t nat -A nixos-nat-out \
  +          ${iptables} -w -t nat -A nixos-nat-out \
               -d ${loopbackip} -p ${fwd.proto} \
               --dport ${builtins.toString fwd.sourcePort} \
               -j DNAT --to-destination ${fwd.destination}
   
             # Allow connections to ${loopbackip}:${toString fwd.sourcePort} from other hosts behind NAT
  -          iptables -w -t nat -A nixos-nat-pre \
  +          ${iptables} -w -t nat -A nixos-nat-pre \
               -d ${loopbackip} -p ${fwd.proto} \
               --dport ${builtins.toString fwd.sourcePort} \
               -j DNAT --to-destination ${fwd.destination}
   
  -          iptables -w -t nat -A nixos-nat-post \
  +          ${iptables} -w -t nat -A nixos-nat-post \
               -d ${destinationIP} -p ${fwd.proto} \
               --dport ${destinationPorts} \
               -j SNAT --to-source ${loopbackip}
           '') fwd.loopbackIPs}
  -    '') cfg.forwardPorts}
  +    '') forwardPorts}
  +  '';
  +
  +  setupNat = ''
  +    ${helpers}
  +    # Create subchains where we store rules
  +    ip46tables -w -t nat -N nixos-nat-pre
  +    ip46tables -w -t nat -N nixos-nat-post
  +    ip46tables -w -t nat -N nixos-nat-out
  +
  +    ${mkSetupNat {
  +      iptables = "iptables";
  +      inherit dest;
  +      inherit (cfg) internalIPs;
  +      forwardPorts = filter (x: !(isIPv6 x.destination)) cfg.forwardPorts;
  +    }}
  +
  +    ${optionalString cfg.enableIPv6 (mkSetupNat {
  +      iptables = "ip6tables";
  +      dest = destIPv6;
  +      internalIPs = cfg.internalIPv6s;
  +      forwardPorts = filter (x: isIPv6 x.destination) cfg.forwardPorts;
  +    })}
   
       ${optionalString (cfg.dmzHost != null) ''
         iptables -w -t nat -A nixos-nat-pre \
  
positive.code:       description =
          ''
            The public IP address to which packets from the local
            network are to be rewritten.  If this is left empty, the
            IP address associated with the external interface will be
            used.
  
negative.code:     (mkIf config.networking.nat.enable {
  
        assertions = [
          { assertion = cfg.enableIPv6           -> config.networking.enableIPv6;
            message = "networking.nat.enableIPv6 requires networking.enableIPv6";
          }
          { assertion = (cfg.dmzHost != null)    -> (cfg.externalInterface != null);
            message = "networking.nat.dmzHost requires networking.nat.externalInterface";
          }
  