anchor.diff:  
       networking.firewall.trustedInterfaces = [ "lo" ];
   
  -    environment.systemPackages = [ pkgs.iptables ];
  +    environment.systemPackages = [ pkgs.iptables ] ++ cfg.extraPackages;
   
       boot.kernelModules = map (x: "nf_conntrack_${x}") cfg.connectionTrackingModules;
       boot.extraModprobeConfig = optionalString (!cfg.autoLoadConntrackHelpers) ''
  
positive.code:         '';
      };
  
      networking.firewall.extraStopCommands = mkOption {
        type = types.lines;
        default = "";
  
negative.code:       before = [ "network-pre.target" ];
        after = [ "systemd-modules-load.service" ];
  
        path = [ pkgs.iptables ] ++ cfg.extraPackages;
  
        # FIXME: this module may also try to load kernel modules, but
        # containers don't have CAP_SYS_MODULE. So the host system had
  