anchor.diff:          '';
       };
   
  +    networking.firewall.trustedInterfaces = mkOption {
  +      type = types.list types.string;
  +      description =
  +        ''
  +          Traffic coming in from these interfaces will be accepted
  +          unconditionally.
  +        '';
  +    };
  +
       networking.firewall.allowedTCPPorts = mkOption {
         default = [];
         example = [ 22 80 ];
  
positive.code:   # they are changed, regardless of whether the start condition
    # holds).
    config = mkIf cfg.enable {
  
      environment.systemPackages = [ pkgs.iptables ];
  
  
negative.code:             # The "nixos-fw" chain does the actual work.
              ip46tables -N nixos-fw
  
              # Accept all traffic on the trusted interfaces.
              ${flip concatMapStrings cfg.trustedInterfaces (iface: ''
                ip46tables -A nixos-fw -i ${iface} -j nixos-fw-accept
              '')}
  
              # Accept packets from established or related connections.
              ip46tables -A nixos-fw -m conntrack --ctstate ESTABLISHED,RELATED -j nixos-fw-accept
  