anchor.diff:            ("pings").  ICMPv6 pings are always allowed because the
             larger address space of IPv6 makes network scanning much
             less effective.
  +        '';
  +    };
  +
  +    networking.firewall.checkReversePath = mkOption {
  +      default = kernelHasRPFilter;
  +      type = types.bool;
  +      description =
  +        ''
  +          Performs a reverse path filter test on a packet.
  +          If a reply to the packet would not be sent via the same interface
  +          that the packet arrived on, it is refused.
  +
  +          If using asymmetric routing or other complicated routing,
  +          disable this setting and setup your own counter-measures.
  +
  +          (needs kernel 3.3+)
           '';
       };
   
  
positive.code:     environment.systemPackages = [ pkgs.iptables ];
  
      boot.kernelModules = [ "nf_conntrack_ftp" ];
  
      jobs.firewall =
        { startOn = "started network-interfaces";
  
negative.code:             # The "nixos-fw" chain does the actual work.
              ip46tables -N nixos-fw
  
              # Perform a reverse-path test to refuse spoofers
              # For now, we just drop, as the raw table doesn't have a log-refuse yet
              ${optionalString (kernelHasRPFilter && cfg.checkReversePath) ''
                ip46tables -A PREROUTING -t raw -m rpfilter --invert -j DROP
              ''}
  
              # Accept all traffic on the trusted interfaces.
              ${flip concatMapStrings cfg.trustedInterfaces (iface: ''
                ip46tables -A nixos-fw -i ${iface} -j nixos-fw-accept
  