anchor.diff:  
       environment.systemPackages = [ pkgs.iptables ];
   
  -    boot.kernelModules = [ "nf_conntrack_ftp" ];
  +    boot.kernelModules = map (x: "nf_conntrack_${x}") cfg.connectionTrackingModules;
  +    boot.extraModprobeConfig = optionalString (!cfg.autoLoadConntrackHelpers) ''
  +      options nf_conntrack nf_conntrack_helper=0
  +    '';
   
       assertions = [ { assertion = ! cfg.checkReversePath || kernelHasRPFilter;
  -                     message = "This kernel does not support rpfilter"; } ];
  +                     message = "This kernel does not support rpfilter"; }
  +                   { assertion = cfg.autoLoadConntrackHelpers || kernelCanDisableHelpers;
  +                     message = "This kernel does not support disabling conntrack helpers"; }
  +                 ];
   
       jobs.firewall =
         { startOn = "started network-interfaces";
  
positive.code:           disable this setting and setup your own counter-measures.
  
            (needs kernel 3.3+)
          '';
      };
  
  
negative.code:                    && kernelPackages.kernel.features ? netfilterRPFilter
                     && kernelPackages.kernel.features.netfilterRPFilter;
  
    kernelCanDisableHelpers = kernelPackages.kernel ? features
                     && kernelPackages.kernel.features ? canDisableNetfilterConntrackHelpers
                     && kernelPackages.kernel.features.canDisableNetfilterConntrackHelpers;
  
  in
  
  {
  