anchor.diff:              # The "nixos-fw" chain does the actual work.
               ip46tables -N nixos-fw
   
  +            # Perform a reverse-path test to refuse spoofers
  +            # For now, we just drop, as the raw table doesn't have a log-refuse yet
  +            ${optionalString (kernelHasRPFilter && cfg.checkReversePath) ''
  +              ip46tables -A PREROUTING -t raw -m rpfilter --invert -j DROP
  +            ''}
  +
               # Accept all traffic on the trusted interfaces.
               ${flip concatMapStrings cfg.trustedInterfaces (iface: ''
                 ip46tables -A nixos-fw -i ${iface} -j nixos-fw-accept
  
positive.code:           ("pings").  ICMPv6 pings are always allowed because the
            larger address space of IPv6 makes network scanning much
            less effective.
          '';
      };
  
  
negative.code:     environment.systemPackages = [ pkgs.iptables ];
  
      boot.kernelModules = [ "nf_conntrack_ftp" ];
  
      assertions = [ { assertion = ! cfg.checkReversePath || kernelHasRPFilter;
                       message = "This kernel does not support rpfilter"; } ];
  
      jobs.firewall =
        { startOn = "started network-interfaces";
  