anchor.diff:              # Accept IPv6 ICMP packets on the local link.  Otherwise
               # stuff like neighbor/router solicitation won't work.
               ip6tables -A INPUT -s fe80::/10 -p icmpv6 -j ACCEPT
  +            ip6tables -A INPUT -d fe80::/10 -p icmpv6 -j ACCEPT
   
               # Optionally respond to pings.
               ${optionalString cfg.allowPing ''
  
positive.code:               ) config.networking.firewall.allowedTCPPorts
              }
  
              # Accept IPv4 multicast.  Not a big security risk since
              # probably nobody is listening anyway.
              iptables -A INPUT -d 224.0.0.0/4 -j ACCEPT
  
negative.code:   
      networking.firewall.allowedTCPPorts = mkOption {
        default = [];
        example = [ 22 80 ];
        type = types.list types.int;
        description =
          ''
            List of TCP ports on which incoming connections are
            accepted.
          '';
      };
    
      networking.firewall.allowedUDPPorts = mkOption {
        default = [];
        example = [ 53 ];
        type = types.list types.int;
        description =
          ''
            List of open UDP ports.
          '';
      };
    
  