anchor.diff:  let
   
     cfg = config.networking.nat;
  +
  +  dest = if cfg.externalIP == null then "-j MASQUERADE" else "-j SNAT --to-source ${cfg.externalIP}";
   
   in
   
  
positive.code: 
          preStart =
            ''
              iptables -t nat -F POSTROUTING
              iptables -t nat -X
            ''
            + (concatMapStrings (network:
              ''
              iptables -t nat -A POSTROUTING \
                -s ${network} -o ${cfg.externalInterface} \
                ${if cfg.externalIP == null
                  then "-j MASQUERADE"
                  else "-j SNAT --to-source ${cfg.externalIP}"}
              ''
            ) cfg.internalIPs) +
            ''
              echo 1 > /proc/sys/net/ipv4/ip_forward
            '';
  
          postStop =
            ''
              iptables -t nat -F POSTROUTING
            '';
        };
    };
  
negative.code:         '';
      };
  
      networking.nat.internalInterfaces = mkOption {
        type = types.listOf types.str;
        default = [];
        example = [ "eth0" ];
        description =
          ''
            The interfaces for which to perform NAT. Packets coming from
            these interface and destined for the external interface will
            be rewritten.
          '';
      };
  
      networking.nat.internalIPs = mkOption {
        type = types.listOf types.str;
        default = [];
        example = [ "192.168.1.0/24" ];
        description =
          ''
            The IP address ranges for which to perform NAT.  Packets
            coming from these addresses (on any interface) and destined
            for the external interface will be rewritten.
          '';
      };
  
  