anchor.diff:            disable this setting and setup your own counter-measures.
   
             (needs kernel 3.3+)
  +        '';
  +    };
  +
  +    networking.firewall.connectionTrackingModules = mkOption {
  +      default = [ "ftp" ];
  +      example = [ "ftp" "irc" "sane" "sip" "tftp" "amanda" "h323" "netbios_sn" "pptp" "snmp" ];
  +      type = types.list types.string;
  +      description =
  +        ''
  +          List of connection-tracking helpers that are auto-loaded.
  +          The complete list of possible values is given in the example.
  +
  +          As helpers can pose as a security risk, it is adviced to
  +          set this to an empty list and disable the setting
  +          networking.firewall.autoLoadConntrackHelpers
  +
  +          Loading of helpers is recommended to be done through the new
  +          CT target. More info:
  +          https://home.regit.org/netfilter-en/secure-use-of-helpers/
  +        '';
  +    };
  +
  +    networking.firewall.autoLoadConntrackHelpers = mkOption {
  +      default = true;
  +      type = types.bool;
  +      description =
  +        ''
  +          Whether to auto-load connection-tracking helpers.
  +          See the description at networking.firewall.connectionTrackingModules
  +
  +          (needs kernel 3.5+)
           '';
       };
   
  
positive.code:                    && kernelPackages.kernel.features ? netfilterRPFilter
                     && kernelPackages.kernel.features.netfilterRPFilter;
  
  in
  
  {
  
negative.code: 
      environment.systemPackages = [ pkgs.iptables ];
  
      boot.kernelModules = map (x: "nf_conntrack_${x}") cfg.connectionTrackingModules;
      boot.extraModprobeConfig = optionalString (!cfg.autoLoadConntrackHelpers) ''
        options nf_conntrack nf_conntrack_helper=0
      '';
  
      assertions = [ { assertion = ! cfg.checkReversePath || kernelHasRPFilter;
                       message = "This kernel does not support rpfilter"; }
                     { assertion = cfg.autoLoadConntrackHelpers || kernelCanDisableHelpers;
                       message = "This kernel does not support disabling conntrack helpers"; }
                   ];
  
      jobs.firewall =
        { startOn = "started network-interfaces";
  