anchor.diff:          description = "The fail2ban package to use for running the fail2ban service.";
         };
   
  +      packageFirewall = mkOption {
  +        default = pkgs.iptables;
  +        type = types.package;
  +        example = "pkgs.nftables";
  +        description = "The firewall package used by fail2ban service.";
  +      };
  +
         daemonConfig = mkOption {
           default = ''
             [Definition]
  
positive.code: 
    };
  
  
    ###### implementation
  
    config = mkIf cfg.enable {
  
negative.code:       restartTriggers = [ fail2banConf jailConf pathsConf ];
        reloadIfChanged = true;
  
        path = [ cfg.package cfg.packageFirewall pkgs.iproute ];
  
        preStart = ''
          mkdir -p /var/lib/fail2ban
  