anchor.diff:  
           preStart =
             ''
  -            # Helper command to manipulate both the IPv4 and IPv6 tables.
  -            ip46tables() {
  -              iptables "$@"
  -              ip6tables "$@"
  -            }
  -
  -            ip46tables -F INPUT
  -            ip46tables -F FW_REFUSE || true
  -            ip46tables -X # flush unused chains
  -            ip46tables -P INPUT ACCEPT
  -
  -
  -            # The "FW_REFUSE" chain performs logging and
  -            # rejecting/dropping of packets.
  -            ip46tables -N FW_REFUSE
  -
  -            ${optionalString cfg.logRefusedConnections ''
  -              ip46tables -A FW_REFUSE -p tcp --syn -j LOG --log-level info --log-prefix "rejected connection: "
  -            ''}
  -            ${optionalString cfg.logRefusedPackets ''
  -              ip46tables -A FW_REFUSE -j LOG --log-level info --log-prefix "rejected packet: "
  -            ''}
  -
  +            ${helpers}
  +            set -x
  +
  +            # Flush the old firewall rules.  !!! Ideally, updating the
  +            # firewall would be atomic.  Apparently that's possible
  +            # with iptables-restore.
  +            ip46tables -D INPUT -j nixos-fw || true
  +            for chain in nixos-fw nixos-fw-accept nixos-fw-log-refuse nixos-fw-refuse FW_REFUSE; do
  +              ip46tables -F "$chain" || true
  +              ip46tables -X "$chain" || true
  +            done
  +
  +
  +            # The "nixos-fw-accept" chain just accepts packets.
  +            ip46tables -N nixos-fw-accept
  +            ip46tables -A nixos-fw-accept -j ACCEPT
  +
  +
  +            # The "nixos-fw-refuse" chain rejects or drops packets.
  +            ip46tables -N nixos-fw-refuse
  +            
               ${if cfg.rejectPackets then ''
                 # Send a reset for existing TCP connections that we've
                 # somehow forgotten about.  Send ICMP "port unreachable"
                 # for everything else.
  -              ip46tables -A FW_REFUSE -p tcp ! --syn -j REJECT --reject-with tcp-reset
  -              ip46tables -A FW_REFUSE -j REJECT
  +              ip46tables -A nixos-fw-refuse -p tcp ! --syn -j REJECT --reject-with tcp-reset
  +              ip46tables -A nixos-fw-refuse -j REJECT
               '' else ''
  -              ip46tables -A FW_REFUSE -j DROP
  -            ''}
  -
  -
  +              ip46tables -A nixos-fw-refuse -j DROP
  +            ''}
  +
  +
  +            # The "nixos-fw-log-refuse" chain performs logging, then
  +            # jumps to the "nixos-fw-refuse" chain.
  +            ip46tables -N nixos-fw-log-refuse
  +
  +            ${optionalString cfg.logRefusedConnections ''
  +              ip46tables -A nixos-fw-log-refuse -p tcp --syn -j LOG --log-level info --log-prefix "rejected connection: "
  +            ''}
  +            ${optionalString (cfg.logRefusedPackets && !cfg.logRefusedUnicastsOnly) ''
  +              ip46tables -A nixos-fw-log-refuse -m pkttype --pkt-type broadcast \
  +                -j LOG --log-level info --log-prefix "rejected broadcast: "
  +              ip46tables -A nixos-fw-log-refuse -m pkttype --pkt-type multicast \
  +                -j LOG --log-level info --log-prefix "rejected multicast: "
  +            ''}
  +            ip46tables -A nixos-fw-log-refuse -m pkttype ! --pkt-type unicast -j nixos-fw-refuse
  +            ${optionalString cfg.logRefusedPackets ''
  +              ip46tables -A nixos-fw-log-refuse \
  +                -j LOG --log-level info --log-prefix "rejected packet: "
  +            ''}
  +            ip46tables -A nixos-fw-log-refuse -j nixos-fw-refuse
  +
  +
  +            # The "nixos-fw" chain does the actual work.
  +            ip46tables -N nixos-fw
  +            
               # Accept all traffic on the loopback interface.
  -            ip46tables -A INPUT -i lo -j ACCEPT
  +            ip46tables -A nixos-fw -i lo -j nixos-fw-accept
   
               # Accept packets from established or related connections.
  -            ip46tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  +            ip46tables -A nixos-fw -m conntrack --ctstate ESTABLISHED,RELATED -j nixos-fw-accept
   
               # Accept connections to the allowed TCP ports.
               ${concatMapStrings (port:
                   ''
  -                  ip46tables -A INPUT -p tcp --dport ${toString port} -j ACCEPT
  +                  ip46tables -A nixos-fw -p tcp --dport ${toString port} -j nixos-fw-accept
                   ''
                 ) cfg.allowedTCPPorts
               }
  
positive.code: let
  
    cfg = config.networking.firewall;
  
  in
  
  
negative.code: /* This module enables a simple firewall.
  
     The firewall can be customised in arbitrary ways by setting
     ‘networking.firewall.extraCommands’.  For modularity, the firewall
     uses several chains:
  
     - ‘nixos-fw-input’ is the main chain for input packet processing.
     
     - ‘nixos-fw-log-refuse’ and ‘nixos-fw-refuse’ are called for
       refused packets.  (The former jumps to the latter after logging
       the packet.)  If you want additional logging, or want to accept
       certain packets anyway, you can insert rules at the start of
       these chain.
  
     - ‘nixos-fw-accept’ is called for accepted packets.  If you want
       additional logging, or want to reject certain packets anyway, you
       can insert rules at the start of this chain.
  
  */
    
  
  
  { config, pkgs, ... }:
  
  