anchor.diff:          '';
       };
     
  -    networking.firewall.allowedTCPPorts = pkgs.lib.mkOption {
  +    networking.firewall.logRefusedConnections = mkOption {
  +      default = true;
  +      description =
  +        ''
  +          Whether to log rejected or dropped incoming connections.
  +        '';
  +    };
  +  
  +    networking.firewall.logRefusedPackets = mkOption {
  +      default = false;
  +      description =
  +        ''
  +          Whether to log all rejected or dropped incoming packets.
  +          This tends to give a lot of log messages, so it's mostly
  +          useful for debugging.
  +        '';
  +    };
  +
  +    networking.firewall.rejectPackets = mkOption {
  +      default = false;
  +      description =
  +        ''
  +          If set, forbidden packets are rejected rather than dropped
  +          (ignored).  This means that a ICMP "port unreachable" error
  +          message is sent back to the client.  Rejecting packets makes
  +          port scanning somewhat easier.
  +        '';
  +    };
  +  
  +    networking.firewall.allowedTCPPorts = mkOption {
         default = [];
         example = [22 80];
  -      type = pkgs.lib.types.list pkgs.lib.types.int;
  +      type = types.list types.int;
         description =
           ''
             List of TCP ports on which incoming connections are
  
positive.code:             ${iptables} -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  
              # Accept connections to the allowed TCP ports.            
              ${pkgs.lib.concatMapStrings (port:
                  ''
                    ${iptables} -A INPUT -p tcp --dport ${toString port} -j ACCEPT
                  ''
  
negative.code:   # doesn't deal with such Upstart jobs properly (it starts them if
    # they are changed, regardless of whether the start condition
    # holds).
    config = mkIf config.networking.firewall.enable {
  
      environment.systemPackages = [pkgs.iptables];
  
      jobs = singleton
        { name = "firewall";
  
          startOn = "network-interfaces/started";
  