anchor.diff:          '';
       };
   
  +    networking.firewall.allowedTCPPortRanges = mkOption {
  +      default = [];
  +      example = [ { from = 8999; to = 9003; } ];
  +      type = types.listOf (types.attrsOf types.int);
  +      description =
  +        ''
  +          A range of TCP ports on which incoming connections are
  +          accepted.
  +        '';
  +    };
  +
       networking.firewall.allowedUDPPorts = mkOption {
         default = [];
         example = [ 53 ];
  
positive.code:       description =
          ''
            List of open UDP ports.
          '';
      };
  
  
negative.code:               ) cfg.allowedTCPPorts
              }
  
              # Accept connections to the allowed TCP port ranges.
              ${concatMapStrings (rangeAttr:
                  let range = toString rangeAttr.from + ":" + toString rangeAttr.to; in
                  ''
                    ip46tables -A nixos-fw -p tcp --dport ${range} -j nixos-fw-accept
                  ''
                ) cfg.allowedTCPPortRanges
              }
  
              # Accept packets on the allowed UDP ports.
              ${concatMapStrings (port:
                  ''
                    ip46tables -A nixos-fw -p udp --dport ${toString port} -j nixos-fw-accept
                  ''
                ) cfg.allowedUDPPorts
              }
  
              # Accept packets on the allowed UDP port ranges.
              ${concatMapStrings (rangeAttr:
                  let range = toString rangeAttr.from + ":" + toString rangeAttr.to; in
                  ''
                    ip46tables -A nixos-fw -p udp --dport ${range} -j nixos-fw-accept
                  ''
                ) cfg.allowedUDPPortRanges
              }
  
              # Accept IPv4 multicast.  Not a big security risk since
  