anchor.diff:      ip46tables -D INPUT -j nixos-fw 2>/dev/null || true
   
       ${optionalString (kernelHasRPFilter && cfg.checkReversePath) ''
  -      if ! ip46tables -D PREROUTING -t raw -m rpfilter --invert -j DROP; then
  -        echo "<2>failed to stop rpfilter support" >&2
  -      fi
  +      ip46tables -t raw -D PREROUTING -j nixos-fw-rpfilter 2>/dev/null || true
       ''}
   
       ${cfg.extraStopCommands}
  
positive.code:     # Perform a reverse-path test to refuse spoofers
      # For now, we just drop, as the raw table doesn't have a log-refuse yet
      ${optionalString (kernelHasRPFilter && cfg.checkReversePath) ''
        if ! ip46tables -A PREROUTING -t raw -m rpfilter --invert -j DROP; then
          echo "<2>failed to initialise rpfilter support" >&2
        fi
      ''}
  
      # Accept all traffic on the trusted interfaces.
  
negative.code:         '';
      };
  
      networking.firewall.logReversePathDrops = mkOption {
        default = false;
        type = types.bool;
        description =
          ''
            Logs dropped packets failing the reverse path filter test if
            the option networking.firewall.checkReversePath is enabled.
          '';
      };
  
      networking.firewall.connectionTrackingModules = mkOption {
        default = [ "ftp" ];
        example = [ "ftp" "irc" "sane" "sip" "tftp" "amanda" "h323" "netbios_sn" "pptp" "snmp" ];
  