anchor.diff:              ${iptables} -A INPUT -d 224.0.0.0/4 -j ACCEPT
   
               # Drop everything else.
  -            ${iptables} -A INPUT -j LOG --log-level info --log-prefix "firewall: "
  -            ${iptables} -A INPUT -j DROP
  +            ${optionalString cfg.logRefusedConnections ''
  +              ${iptables} -A INPUT -p tcp --syn -j LOG --log-level info --log-prefix "rejected connection: "
  +            ''}
  +            ${optionalString cfg.logRefusedPackets ''
  +              ${iptables} -A INPUT -j LOG --log-level info --log-prefix "rejected packet: "
  +            ''}
  +            ${iptables} -A INPUT -j ${if cfg.rejectPackets then "REJECT" else "DROP"}
             '';
   
           postStop =
  
positive.code:             ${iptables} -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  
              # Accept connections to the allowed TCP ports.            
              ${pkgs.lib.concatMapStrings (port:
                  ''
                    ${iptables} -A INPUT -p tcp --dport ${toString port} -j ACCEPT
                  ''
  
negative.code: { config, pkgs, ... }:
  
  with pkgs.lib;
  
  let
  
    iptables = "${pkgs.iptables}/sbin/iptables";
  
    cfg = config.networking.firewall;
  
  in
  
  