anchor.diff:            ''
               iptables -t nat -F POSTROUTING
               iptables -t nat -X
  -          '' 
  -          + (concatMapStrings (network: 
  -            ''
  +
               iptables -t nat -A POSTROUTING \
  -              -s ${network} -o ${cfg.externalInterface} \
  +              -s ${cfg.internalIPs} -o ${cfg.externalInterface} \
                 ${if cfg.externalIP == ""
                   then "-j MASQUERADE"
                   else "-j SNAT --to-source ${cfg.externalIP}"}
  -            ''
  -          ) cfg.internalIPs) +
  -          ''
  +
               echo 1 > /proc/sys/net/ipv4/ip_forward
             '';
   
  
positive.code:             iptables -t nat -F POSTROUTING
            '';
        };
    };
  }
  
negative.code:     };
  
      networking.nat.internalIPs = mkOption {
        example = "192.168.1.0/24";
        description =
          ''
            The IP address range for which to perform NAT.  Packets
            coming from these addresses and destined for the external
            interface will be rewritten.
          '';
      };
  