anchor.diff:  let
   
     cfg = config.networking.firewall;
  +
  +  helpers =
  +    ''
  +      # Helper command to manipulate both the IPv4 and IPv6 tables.
  +      ip46tables() {
  +        iptables "$@"
  +        ip6tables "$@"
  +      }
  +    '';
   
   in
   
  
positive.code:     };
    
      networking.firewall.logRefusedPackets = mkOption {
        default = false;
        description =
          ''
            Whether to log all rejected or dropped incoming packets.
            This tends to give a lot of log messages, so it's mostly
            useful for debugging.
          '';
      };
  
  
negative.code: 
          preStart =
            ''
              ${helpers}
              set -x
  
              # Flush the old firewall rules.  !!! Ideally, updating the
              # firewall would be atomic.  Apparently that's possible
              # with iptables-restore.
              ip46tables -D INPUT -j nixos-fw || true
              for chain in nixos-fw nixos-fw-accept nixos-fw-log-refuse nixos-fw-refuse FW_REFUSE; do
                ip46tables -F "$chain" || true
                ip46tables -X "$chain" || true
              done
  
  
              # The "nixos-fw-accept" chain just accepts packets.
              ip46tables -N nixos-fw-accept
              ip46tables -A nixos-fw-accept -j ACCEPT
  
  
              # The "nixos-fw-refuse" chain rejects or drops packets.
              ip46tables -N nixos-fw-refuse
              
              ${if cfg.rejectPackets then ''
                # Send a reset for existing TCP connections that we've
                # somehow forgotten about.  Send ICMP "port unreachable"
                # for everything else.
                ip46tables -A nixos-fw-refuse -p tcp ! --syn -j REJECT --reject-with tcp-reset
                ip46tables -A nixos-fw-refuse -j REJECT
              '' else ''
                ip46tables -A nixos-fw-refuse -j DROP
              ''}
  
  
              # The "nixos-fw-log-refuse" chain performs logging, then
              # jumps to the "nixos-fw-refuse" chain.
              ip46tables -N nixos-fw-log-refuse
  
              ${optionalString cfg.logRefusedConnections ''
                ip46tables -A nixos-fw-log-refuse -p tcp --syn -j LOG --log-level info --log-prefix "rejected connection: "
              ''}
              ${optionalString (cfg.logRefusedPackets && !cfg.logRefusedUnicastsOnly) ''
                ip46tables -A nixos-fw-log-refuse -m pkttype --pkt-type broadcast \
                  -j LOG --log-level info --log-prefix "rejected broadcast: "
                ip46tables -A nixos-fw-log-refuse -m pkttype --pkt-type multicast \
                  -j LOG --log-level info --log-prefix "rejected multicast: "
              ''}
              ip46tables -A nixos-fw-log-refuse -m pkttype ! --pkt-type unicast -j nixos-fw-refuse
              ${optionalString cfg.logRefusedPackets ''
                ip46tables -A nixos-fw-log-refuse \
                  -j LOG --log-level info --log-prefix "rejected packet: "
              ''}
              ip46tables -A nixos-fw-log-refuse -j nixos-fw-refuse
  
  
              # The "nixos-fw" chain does the actual work.
              ip46tables -N nixos-fw
              
              # Accept all traffic on the loopback interface.
              ip46tables -A nixos-fw -i lo -j nixos-fw-accept
  
              # Accept packets from established or related connections.
              ip46tables -A nixos-fw -m conntrack --ctstate ESTABLISHED,RELATED -j nixos-fw-accept
  
              # Accept connections to the allowed TCP ports.
              ${concatMapStrings (port:
                  ''
                    ip46tables -A nixos-fw -p tcp --dport ${toString port} -j nixos-fw-accept
                  ''
                ) cfg.allowedTCPPorts
              }
  