anchor.diff:  
     options = {
     
  -    networking.firewall.enable = pkgs.lib.mkOption {
  +    networking.firewall.enable = mkOption {
         default = false;
         description =
           ''
  
positive.code:             ${iptables} -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  
              # Accept connections to the allowed TCP ports.            
              ${pkgs.lib.concatMapStrings (port:
                  ''
                    ${iptables} -A INPUT -p tcp --dport ${toString port} -j ACCEPT
                  ''
  
negative.code:         '';
      };
    
      networking.firewall.logRefusedConnections = mkOption {
        default = true;
        description =
          ''
            Whether to log rejected or dropped incoming connections.
          '';
      };
    
      networking.firewall.logRefusedPackets = mkOption {
        default = false;
        description =
          ''
            Whether to log all rejected or dropped incoming packets.
            This tends to give a lot of log messages, so it's mostly
            useful for debugging.
          '';
      };
  
      networking.firewall.rejectPackets = mkOption {
        default = false;
        description =
          ''
            If set, forbidden packets are rejected rather than dropped
            (ignored).  This means that a ICMP "port unreachable" error
            message is sent back to the client.  Rejecting packets makes
            port scanning somewhat easier.
          '';
      };
    
      networking.firewall.allowedTCPPorts = mkOption {
        default = [];
        example = [22 80];
        type = types.list types.int;
        description =
          ''
            List of TCP ports on which incoming connections are
  