anchor.diff:        options nf_conntrack nf_conntrack_helper=0
       '';
   
  -    assertions = [ { assertion = ! cfg.checkReversePath || kernelHasRPFilter;
  +    assertions = [ { assertion = ! cfg.checkReversePath;
                        message = "This kernel does not support rpfilter"; }
                      { assertion = cfg.autoLoadConntrackHelpers || kernelCanDisableHelpers;
                        message = "This kernel does not support disabling conntrack helpers"; }
  
positive.code: 
      # Perform a reverse-path test to refuse spoofers
      # For now, we just drop, as the raw table doesn't have a log-refuse yet
      ${optionalString (kernelHasRPFilter && cfg.checkReversePath) ''
        if ! ip46tables -A PREROUTING -t raw -m rpfilter --invert -j DROP; then
          echo "<2>failed to initialise rpfilter support" >&2
        fi
  
negative.code:     };
  
      networking.firewall.checkReversePath = mkOption {
        default = false;
        type = types.bool;
        description =
          ''
  