anchor.diff:        };
   
       testScript =
  -      { nodes, ... }:
  -      ''
  -        startAll;
  +      { nodes, ... }: let
  +        routerDummyNoNatClosure = nodes.routerDummyNoNat.config.system.build.toplevel;
  +        routerClosure = nodes.router.config.system.build.toplevel;
  +      in ''
  +        $client->start;
  +        $router->start;
  +        $server->start;
   
           # The router should have access to the server.
           $server->waitForUnit("network.target");
  
positive.code:         $router->succeed("ping -c 1 client >&2");
  
          # If we turn off NAT, the client shouldn't be able to reach the server.
          $router->succeed("iptables -t nat -D PREROUTING -j nixos-nat-pre");
          $router->succeed("iptables -t nat -D POSTROUTING -j nixos-nat-post");
          $client->fail("curl --fail --connect-timeout 5 http://server/ >&2");
          $client->fail("ping -c 1 server >&2");
  
          # And make sure that reloading the NAT job works.
          $router->succeed("systemctl restart ${unit}");
          $client->succeed("curl --fail http://server/ >&2");
          $client->succeed("ping -c 1 server >&2");
        '';
  
negative.code:           ];
  
          router =
          { config, pkgs, ... }: lib.mkMerge [
            routerBase
            { networking.nat.enable = true; }
          ];
  
          routerDummyNoNat =
          { config, pkgs, ... }: lib.mkMerge [
            routerBase
            { networking.nat.enable = false; }
          ];
  
          server =
            { config, pkgs, ... }:
  