anchor.diff: -# This module enables a simple firewall.
  +/* This module enables a simple firewall.
  +
  +   The firewall can be customised in arbitrary ways by setting
  +   ‘networking.firewall.extraCommands’.  For modularity, the firewall
  +   uses several chains:
  +
  +   - ‘nixos-fw-input’ is the main chain for input packet processing.
  +   
  +   - ‘nixos-fw-log-refuse’ and ‘nixos-fw-refuse’ are called for
  +     refused packets.  (The former jumps to the latter after logging
  +     the packet.)  If you want additional logging, or want to accept
  +     certain packets anyway, you can insert rules at the start of
  +     these chain.
  +
  +   - ‘nixos-fw-accept’ is called for accepted packets.  If you want
  +     additional logging, or want to reject certain packets anyway, you
  +     can insert rules at the start of this chain.
  +
  +*/
  +  
  +
   
   { config, pkgs, ... }:
   
  
positive.code:             # Accept packets on the allowed UDP ports.
              ${concatMapStrings (port:
                  ''
                    ip46tables -A INPUT -p udp --dport ${toString port} -j ACCEPT
                  ''
                ) cfg.allowedUDPPorts
              }
  
              # Accept IPv4 multicast.  Not a big security risk since
              # probably nobody is listening anyway.
              iptables -A INPUT -d 224.0.0.0/4 -j ACCEPT
  
              # Optionally respond to ICMPv4 pings.
              ${optionalString cfg.allowPing ''
                iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
              ''}
  
              # Accept all ICMPv6 messages except redirects and node
              # information queries (type 139).  See RFC 4890, section
              # 4.4.
              ip6tables -A INPUT -p icmpv6 --icmpv6-type redirect -j DROP
              ip6tables -A INPUT -p icmpv6 --icmpv6-type 139 -j DROP
              ip6tables -A INPUT -p icmpv6 -j ACCEPT
  
              ${cfg.extraCommands}
  
              # Reject/drop everything else.
              ip46tables -A INPUT -j FW_REFUSE
            '';
  
          postStop =
            ''
              iptables -F INPUT
              iptables -P INPUT ACCEPT
              ip6tables -F INPUT
              ip6tables -P INPUT ACCEPT
            '';
        };
  
  
negative.code: let
  
    cfg = config.networking.firewall;
  
    helpers =
      ''
        # Helper command to manipulate both the IPv4 and IPv6 tables.
        ip46tables() {
          iptables "$@"
          ip6tables "$@"
        }
      '';
  
  in
  
  