anchor.diff:            ''
               iptables -t nat -F POSTROUTING
               iptables -t nat -X
  -
  +          '' 
  +          + (concatMapStrings (network: 
  +            ''
               iptables -t nat -A POSTROUTING \
  -              -s ${cfg.internalIPs} -o ${cfg.externalInterface} \
  +              -s ${network} -o ${cfg.externalInterface} \
                 ${if cfg.externalIP == ""
                   then "-j MASQUERADE"
                   else "-j SNAT --to-source ${cfg.externalIP}"}
  -
  +            ''
  +          ) cfg.internalIPs) +
  +          ''
               echo 1 > /proc/sys/net/ipv4/ip_forward
             '';
   
  
positive.code:             iptables -t nat -F POSTROUTING
            '';
        };
  
    };
  
  }
  
negative.code: # This module enables Network Address Translation (NAT).
  # XXX: todo: support multiple upstream links
  # see http://yesican.chsoft.biz/lartc/MultihomedLinuxNetworking.html
  
  { config, pkgs, ... }:
  
  