anchor.diff:  
       # Perform a reverse-path test to refuse spoofers
       # For now, we just drop, as the raw table doesn't have a log-refuse yet
  -    ${optionalString (kernelHasRPFilter && cfg.checkReversePath) ''
  +    ${optionalString cfg.checkReversePath ''
         if ! ip46tables -A PREROUTING -t raw -m rpfilter --invert -j DROP; then
           echo "<2>failed to initialise rpfilter support" >&2
         fi
  
positive.code:     };
  
      networking.firewall.checkReversePath = mkOption {
        default = kernelHasRPFilter;
        type = types.bool;
        description =
          ''
  
negative.code:     # Clean up after added ruleset
      ip46tables -D INPUT -j nixos-fw 2>/dev/null || true
  
      ${optionalString cfg.checkReversePath ''
        if ! ip46tables -D PREROUTING -t raw -m rpfilter --invert -j DROP; then
          echo "<2>failed to stop rpfilter support" >&2
        fi
  