anchor.diff:    # doesn't deal with such Upstart jobs properly (it starts them if
     # they are changed, regardless of whether the start condition
     # holds).
  -  config = mkIf config.networking.firewall.enable {
  +  config = mkIf cfg.enable {
   
       environment.systemPackages = [ pkgs.iptables ];
   
  
positive.code:                 ''
                    ip46tables -A INPUT -p tcp --dport ${toString port} -j ACCEPT
                  ''
                ) config.networking.firewall.allowedTCPPorts
              }
  
              # Accept packets on the allowed UDP ports.
  
negative.code: 
          preStart =
            ''
              # Helper command to manipulate both the IPv4 and IPv6 tables.
              ip46tables() {
                iptables "$@"
                ip6tables "$@"
  