anchor.diff: -# This module enables a simple firewall.
  +/* This module enables a simple firewall.
  +
  +   The firewall can be customised in arbitrary ways by setting
  +   ‘networking.firewall.extraCommands’.  For modularity, the firewall
  +   uses several chains:
  +
  +   - ‘nixos-fw-input’ is the main chain for input packet processing.
  +   
  +   - ‘nixos-fw-log-refuse’ and ‘nixos-fw-refuse’ are called for
  +     refused packets.  (The former jumps to the latter after logging
  +     the packet.)  If you want additional logging, or want to accept
  +     certain packets anyway, you can insert rules at the start of
  +     these chain.
  +
  +   - ‘nixos-fw-accept’ is called for accepted packets.  If you want
  +     additional logging, or want to reject certain packets anyway, you
  +     can insert rules at the start of this chain.
  +
  +*/
  +  
  +
   
   { config, pkgs, ... }:
   
  
positive.code:     };
    
      networking.firewall.logRefusedPackets = mkOption {
        default = false;
        description =
          ''
            Whether to log all rejected or dropped incoming packets.
            This tends to give a lot of log messages, so it's mostly
            useful for debugging.
          '';
      };
  
  
negative.code:             # Accept packets on the allowed UDP ports.
              ${concatMapStrings (port:
                  ''
                    ip46tables -A nixos-fw -p udp --dport ${toString port} -j nixos-fw-accept
                  ''
                ) cfg.allowedUDPPorts
              }
  
              # Accept IPv4 multicast.  Not a big security risk since
              # probably nobody is listening anyway.
              #iptables -A nixos-fw -d 224.0.0.0/4 -j nixos-fw-accept
  
              # Optionally respond to ICMPv4 pings.
              ${optionalString cfg.allowPing ''
                iptables -A nixos-fw -p icmp --icmp-type echo-request -j nixos-fw-accept
              ''}
  
              # Accept all ICMPv6 messages except redirects and node
              # information queries (type 139).  See RFC 4890, section
              # 4.4.
              ip6tables -A nixos-fw -p icmpv6 --icmpv6-type redirect -j DROP
              ip6tables -A nixos-fw -p icmpv6 --icmpv6-type 139 -j DROP
              ip6tables -A nixos-fw -p icmpv6 -j nixos-fw-accept
  
              ${cfg.extraCommands}
  
              # Reject/drop everything else.
              ip46tables -A nixos-fw -j nixos-fw-log-refuse
  
  
              # Enable the firewall.
              ip46tables -A INPUT -j nixos-fw
            '';
  
          postStop =
            ''
              ${helpers}
              ip46tables -D INPUT -j nixos-fw || true
              #ip46tables -P INPUT ACCEPT
            '';
        };
  
  