anchor.diff:      { networking.firewall.extraCommands = mkBefore flushNat; }
       (mkIf config.networking.nat.enable {
   
  +      assertions = [
  +        { assertion = (cfg.dmzHost != null)    -> (cfg.externalInterface != null);
  +          message = "networking.nat.dmzHost requires networking.nat.externalInterface";
  +        }
  +        { assertion = (cfg.forwardPorts != []) -> (cfg.externalInterface != null);
  +          message = "networking.nat.forwardPorts requires networking.nat.externalInterface";
  +        }
  +      ];
  +
         environment.systemPackages = [ pkgs.iptables ];
   
         boot = {
  
positive.code:     };
  
      networking.nat.externalInterface = mkOption {
        type = types.str;
        example = "eth1";
        description =
          ''
  
negative.code:     # NAT the marked packets.
      ${optionalString (cfg.internalInterfaces != []) ''
        iptables -w -t nat -A nixos-nat-post -m mark --mark 1 \
          ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest}
      ''}
  
      # NAT packets coming from the internal IPs.
      ${concatMapStrings (range: ''
        iptables -w -t nat -A nixos-nat-post \
          -s '${range}' ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest}
      '') cfg.internalIPs}
  
      # NAT from external ports to internal ports.
  