anchor.diff:            ip46tables -A nixos-fw -p udp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "any") "-i ${iface}"}
           ''
         ) cfg.allowedUDPPorts
  -    ) (cfg.interfaces // {any={allowedUDPPorts = cfg.allowedUDPPorts;};}))}
  +    ) allInterfaces)}
   
       # Accept packets on the allowed UDP port ranges.
       ${concatStrings (mapAttrsToList (iface: cfg:
  
positive.code:           ip46tables -A nixos-fw -p udp --dport ${range} -j nixos-fw-accept ${optionalString (iface != "any") "-i ${iface}"}
          ''
        ) cfg.allowedUDPPortRanges
      ) (cfg.interfaces // {any={allowedUDPPortRanges = cfg.allowedUDPPortRanges;};}))}
  
      # Accept IPv4 multicast.  Not a big security risk since
      # probably nobody is listening anyway.
  
negative.code:     ${text}
    ''; in "${dir}/bin/${name}";
  
    anyInterface = { any = mapAttrs (name: value: cfg."${name}") commonOptions; };
    allInterfaces = anyInterface // cfg.interfaces;
  
    startScript = writeShScript "firewall-start" ''
      ${helpers}
  
  