anchor.diff:          '';
       };
   
  +    networking.nat.enableIPv6 = mkOption {
  +      type = types.bool;
  +      default = false;
  +      description =
  +        ''
  +          Whether to enable IPv6 NAT.
  +        '';
  +    };
  +
       networking.nat.internalInterfaces = mkOption {
         type = types.listOf types.str;
         default = [];
  
positive.code:     ${cfg.extraStopCommands}
    '';
  
    setupNat = ''
      ${helpers}
      # Create subchain where we store rules
      ip46tables -w -t nat -N nixos-nat-pre
      ip46tables -w -t nat -N nixos-nat-post
      ip46tables -w -t nat -N nixos-nat-out
  
      # We can't match on incoming interface in POSTROUTING, so
      # mark packets coming from the internal interfaces.
      ${concatMapStrings (iface: ''
        iptables -w -t nat -A nixos-nat-pre \
          -i '${iface}' -j MARK --set-mark 1
      '') cfg.internalInterfaces}
  
      # NAT the marked packets.
      ${optionalString (cfg.internalInterfaces != []) ''
        iptables -w -t nat -A nixos-nat-post -m mark --mark 1 \
          ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest}
      ''}
  
      # NAT packets coming from the internal IPs.
      ${concatMapStrings (range: ''
        iptables -w -t nat -A nixos-nat-post \
          -s '${range}' ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest}
      '') cfg.internalIPs}
  
      # NAT from external ports to internal ports.
      ${concatMapStrings (fwd: ''
        iptables -w -t nat -A nixos-nat-pre \
          -i ${toString cfg.externalInterface} -p ${fwd.proto} \
          --dport ${builtins.toString fwd.sourcePort} \
          -j DNAT --to-destination ${fwd.destination}
  
        ${concatMapStrings (loopbackip:
          let
            m                = builtins.match "([0-9.]+):([0-9-]+)" fwd.destination;
            destinationIP    = if (m == null) then throw "bad ip:ports `${fwd.destination}'" else elemAt m 0;
            destinationPorts = if (m == null) then throw "bad ip:ports `${fwd.destination}'" else builtins.replaceStrings ["-"] [":"] (elemAt m 1);
          in ''
            # Allow connections to ${loopbackip}:${toString fwd.sourcePort} from the host itself
            iptables -w -t nat -A nixos-nat-out \
              -d ${loopbackip} -p ${fwd.proto} \
              --dport ${builtins.toString fwd.sourcePort} \
              -j DNAT --to-destination ${fwd.destination}
  
            # Allow connections to ${loopbackip}:${toString fwd.sourcePort} from other hosts behind NAT
            iptables -w -t nat -A nixos-nat-pre \
              -d ${loopbackip} -p ${fwd.proto} \
              --dport ${builtins.toString fwd.sourcePort} \
              -j DNAT --to-destination ${fwd.destination}
  
            iptables -w -t nat -A nixos-nat-post \
              -d ${destinationIP} -p ${fwd.proto} \
              --dport ${destinationPorts} \
              -j SNAT --to-source ${loopbackip}
          '') fwd.loopbackIPs}
      '') cfg.forwardPorts}
  
      ${optionalString (cfg.dmzHost != null) ''
        iptables -w -t nat -A nixos-nat-pre \
  
negative.code:         };
        });
        default = [];
        example = [
          { sourcePort = 8080; destination = "10.0.0.1:80"; proto = "tcp"; }
          { sourcePort = 8080; destination = "[fc00::2]:80"; proto = "tcp"; }
        ];
        description =
          ''
            List of forwarded ports from the external interface to
            internal destinations by using DNAT. Destination can be
            IPv6 if IPv6 NAT is enabled.
          '';
      };
  
  