anchor.diff:  
       networking.firewall.rejectPackets = mkOption {
         type = types.bool;
  -      default = false;
  +      default = true;
         description =
           ''
             If set, forbidden packets are rejected rather than dropped
  
positive.code:     };
  
      networking.firewall.allowPing = mkOption {
        default = false;
        type = types.bool;
        description =
          ''
  
negative.code: 
      networking.firewall.logRefusedConnections = mkOption {
        type = types.bool;
        default = false;
        description =
          ''
            Whether to log rejected or dropped incoming connections.
  