anchor.diff:        description =
           ''
             List of open UDP ports.
  +        '';
  +    };
  +
  +    networking.firewall.allowedUDPPortRanges = mkOption {
  +      default = [];
  +      example = [ { from = 60000; to = 61000; } ];
  +      type = types.listOf (types.attrsOf types.int);
  +      description =
  +        ''
  +          Range of open UDP ports.
           '';
       };
   
  
positive.code:         '';
      };
  
      networking.firewall.allowedUDPPorts = mkOption {
        default = [];
        example = [ 53 ];
  
negative.code:               ) cfg.allowedTCPPorts
              }
  
              # Accept connections to the allowed TCP port ranges.
              ${concatMapStrings (rangeAttr:
                  let range = toString rangeAttr.from + ":" + toString rangeAttr.to; in
                  ''
                    ip46tables -A nixos-fw -p tcp --dport ${range} -j nixos-fw-accept
                  ''
                ) cfg.allowedTCPPortRanges
              }
  
              # Accept packets on the allowed UDP ports.
              ${concatMapStrings (port:
                  ''
                    ip46tables -A nixos-fw -p udp --dport ${toString port} -j nixos-fw-accept
                  ''
                ) cfg.allowedUDPPorts
              }
  
              # Accept packets on the allowed UDP port ranges.
              ${concatMapStrings (rangeAttr:
                  let range = toString rangeAttr.from + ":" + toString rangeAttr.to; in
                  ''
                    ip46tables -A nixos-fw -p udp --dport ${range} -j nixos-fw-accept
                  ''
                ) cfg.allowedUDPPortRanges
              }
  
              # Accept IPv4 multicast.  Not a big security risk since
  