···102102103103 # If we turn off NAT, the client shouldn't be able to reach the server.
104104 $router->succeed("${routerDummyNoNatClosure}/bin/switch-to-configuration test 2>&1");
105105- # FIXME: this should not be necessary, but nat.service is not started because
106106- # network.target is not triggered
107107- # (https://github.com/NixOS/nixpkgs/issues/16230#issuecomment-226408359)
108108- ${lib.optional (!withFirewall) ''
109109- $router->succeed("systemctl start nat.service");
110110- ''}
111105 $client->fail("curl --fail --connect-timeout 5 http://server/ >&2");
112106 $client->fail("ping -c 1 server >&2");
113107114108 # And make sure that reloading the NAT job works.
115109 $router->succeed("${routerClosure}/bin/switch-to-configuration test 2>&1");
110110+ # FIXME: this should not be necessary, but nat.service is not started because
111111+ # network.target is not triggered
112112+ # (https://github.com/NixOS/nixpkgs/issues/16230#issuecomment-226408359)
113113+ ${lib.optionalString (!withFirewall) ''
114114+ $router->succeed("systemctl start nat.service");
115115+ ''}
116116 $client->succeed("curl --fail http://server/ >&2");
117117 $client->succeed("ping -c 1 server >&2");
118118 '';