anchor.diff:              # The "nixos-fw" chain does the actual work.
               ip46tables -N nixos-fw
   
  -            # Accept all traffic on the loopback interface.
  -            ip46tables -A nixos-fw -i lo -j nixos-fw-accept
  +            # Accept all traffic on the trusted interfaces.
  +            ${flip concatMapStrings cfg.trustedInterfaces (iface: ''
  +              ip46tables -A nixos-fw -i ${iface} -j nixos-fw-accept
  +            '')}
   
               # Accept packets from established or related connections.
               ip46tables -A nixos-fw -m conntrack --ctstate ESTABLISHED,RELATED -j nixos-fw-accept
  
positive.code:         '';
      };
  
      networking.firewall.allowedTCPPorts = mkOption {
        default = [];
        example = [ 22 80 ];
  
negative.code:   # they are changed, regardless of whether the start condition
    # holds).
    config = mkIf cfg.enable {
  
      networking.firewall.trustedInterfaces = [ "lo" ];
  
      environment.systemPackages = [ pkgs.iptables ];
  
  