anchor.diff:        }
       '';
   
  +  kernelPackages = config.boot.kernelPackages;
  +  kernelHasRPFilter = kernelPackages.kernel ? features
  +                   && kernelPackages.kernel.features ? netfilterRPFilter
  +                   && kernelPackages.kernel.features.netfilterRPFilter;
  +
   in
   
   {
  
positive.code:           ("pings").  ICMPv6 pings are always allowed because the
            larger address space of IPv6 makes network scanning much
            less effective.
          '';
      };
  
  
negative.code:             # The "nixos-fw" chain does the actual work.
              ip46tables -N nixos-fw
  
              # Perform a reverse-path test to refuse spoofers
              # For now, we just drop, as the raw table doesn't have a log-refuse yet
              ${optionalString (kernelHasRPFilter && cfg.checkReversePath) ''
                ip46tables -A PREROUTING -t raw -m rpfilter --invert -j DROP
              ''}
  
              # Accept all traffic on the trusted interfaces.
              ${flip concatMapStrings cfg.trustedInterfaces (iface: ''
                ip46tables -A nixos-fw -i ${iface} -j nixos-fw-accept
  