anchor.diff:              # Accept packets on the allowed UDP ports.
               ${concatMapStrings (port:
                   ''
  -                  ip46tables -A INPUT -p udp --dport ${toString port} -j ACCEPT
  +                  ip46tables -A nixos-fw -p udp --dport ${toString port} -j nixos-fw-accept
                   ''
                 ) cfg.allowedUDPPorts
               }
   
               # Accept IPv4 multicast.  Not a big security risk since
               # probably nobody is listening anyway.
  -            iptables -A INPUT -d 224.0.0.0/4 -j ACCEPT
  +            #iptables -A nixos-fw -d 224.0.0.0/4 -j nixos-fw-accept
   
               # Optionally respond to ICMPv4 pings.
               ${optionalString cfg.allowPing ''
  -              iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
  +              iptables -A nixos-fw -p icmp --icmp-type echo-request -j nixos-fw-accept
               ''}
   
               # Accept all ICMPv6 messages except redirects and node
               # information queries (type 139).  See RFC 4890, section
               # 4.4.
  -            ip6tables -A INPUT -p icmpv6 --icmpv6-type redirect -j DROP
  -            ip6tables -A INPUT -p icmpv6 --icmpv6-type 139 -j DROP
  -            ip6tables -A INPUT -p icmpv6 -j ACCEPT
  +            ip6tables -A nixos-fw -p icmpv6 --icmpv6-type redirect -j DROP
  +            ip6tables -A nixos-fw -p icmpv6 --icmpv6-type 139 -j DROP
  +            ip6tables -A nixos-fw -p icmpv6 -j nixos-fw-accept
   
               ${cfg.extraCommands}
   
               # Reject/drop everything else.
  -            ip46tables -A INPUT -j FW_REFUSE
  +            ip46tables -A nixos-fw -j nixos-fw-log-refuse
  +
  +
  +            # Enable the firewall.
  +            ip46tables -A INPUT -j nixos-fw
             '';
   
           postStop =
             ''
  -            iptables -F INPUT
  -            iptables -P INPUT ACCEPT
  -            ip6tables -F INPUT
  -            ip6tables -P INPUT ACCEPT
  +            ${helpers}
  +            ip46tables -D INPUT -j nixos-fw || true
  +            #ip46tables -P INPUT ACCEPT
             '';
         };
   
  
positive.code: 
          preStart =
            ''
              # Helper command to manipulate both the IPv4 and IPv6 tables.
              ip46tables() {
                iptables "$@"
                ip6tables "$@"
              }
  
              ip46tables -F INPUT
              ip46tables -F FW_REFUSE || true
              ip46tables -X # flush unused chains
              ip46tables -P INPUT ACCEPT
  
  
              # The "FW_REFUSE" chain performs logging and
              # rejecting/dropping of packets.
              ip46tables -N FW_REFUSE
  
              ${optionalString cfg.logRefusedConnections ''
                ip46tables -A FW_REFUSE -p tcp --syn -j LOG --log-level info --log-prefix "rejected connection: "
              ''}
              ${optionalString cfg.logRefusedPackets ''
                ip46tables -A FW_REFUSE -j LOG --log-level info --log-prefix "rejected packet: "
              ''}
  
              ${if cfg.rejectPackets then ''
                # Send a reset for existing TCP connections that we've
                # somehow forgotten about.  Send ICMP "port unreachable"
                # for everything else.
                ip46tables -A FW_REFUSE -p tcp ! --syn -j REJECT --reject-with tcp-reset
                ip46tables -A FW_REFUSE -j REJECT
              '' else ''
                ip46tables -A FW_REFUSE -j DROP
              ''}
  
  
              # Accept all traffic on the loopback interface.
              ip46tables -A INPUT -i lo -j ACCEPT
  
              # Accept packets from established or related connections.
              ip46tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  
              # Accept connections to the allowed TCP ports.
              ${concatMapStrings (port:
                  ''
                    ip46tables -A INPUT -p tcp --dport ${toString port} -j ACCEPT
                  ''
                ) cfg.allowedTCPPorts
              }
  
negative.code:     };
    
      networking.firewall.logRefusedPackets = mkOption {
        default = true;
        description =
          ''
            Whether to log all rejected or dropped incoming packets.
            This tends to give a lot of log messages, so it's mostly
            useful for debugging.
          '';
      };
  
      networking.firewall.logRefusedUnicastsOnly = mkOption {
        default = true;
        description =
          ''
            If <option>networking.firewall.logRefusedPackets</option>
            and this option are enabled, then only log packets
            specifically directed at this machine, i.e., not broadcasts
            or multicasts.
          '';
      };
  
  