anchor.diff:              ip6tables -A INPUT -p icmpv6 --icmpv6-type redirect -j DROP
               ip6tables -A INPUT -p icmpv6 --icmpv6-type 139 -j DROP
               ip6tables -A INPUT -p icmpv6 -j ACCEPT
  +
  +            ${cfg.extraCommands}
   
               # Reject/drop everything else.
               ip46tables -A INPUT -j FW_REFUSE
  
positive.code:           ("pings").  ICMPv6 pings are always allowed because the
            larger address space of IPv6 makes network scanning much
            less effective.
          '';
      };
    
  
negative.code:             ip46tables -F INPUT
              ip46tables -F FW_REFUSE || true
              ip46tables -X # flush unused chains
              ip46tables -P INPUT ACCEPT
  
  
              # The "FW_REFUSE" chain performs logging and
  