anchor.diff:              ${iptables} -A INPUT -d 224.0.0.0/4 -j ACCEPT
   
               # Drop everything else.
  -            ${iptables} -A INPUT -j LOG --log-level info --log-prefix "firewall: "
  -            ${iptables} -A INPUT -j DROP
  +            ${optionalString cfg.logRefusedConnections ''
  +              ${iptables} -A INPUT -p tcp --syn -j LOG --log-level info --log-prefix "rejected connection: "
  +            ''}
  +            ${optionalString cfg.logRefusedPackets ''
  +              ${iptables} -A INPUT -j LOG --log-level info --log-prefix "rejected packet: "
  +            ''}
  +            ${iptables} -A INPUT -j ${if cfg.rejectPackets then "REJECT" else "DROP"}
             '';
   
           postStop =
  
positive.code:   # doesn't deal with such Upstart jobs properly (it starts them if
    # they are changed, regardless of whether the start condition
    # holds).
    config = pkgs.lib.mkIf config.networking.firewall.enable {
  
      environment.systemPackages = [pkgs.iptables];
  
      jobs = pkgs.lib.singleton
        { name = "firewall";
  
          startOn = "network-interfaces/started";
  
negative.code: 
    options = {
    
      networking.firewall.enable = mkOption {
        default = false;
        description =
          ''
  