anchor.diff:            ip46tables -A nixos-fw -p tcp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "any") "-i ${iface}"}
           ''
         ) cfg.allowedTCPPorts
  -    ) (cfg.interfaces // {any={allowedTCPPorts = cfg.allowedTCPPorts;};}))}
  +    ) allInterfaces)}
   
       # Accept connections to the allowed TCP port ranges.
       ${concatStrings (mapAttrsToList (iface: cfg:
  
positive.code:           ip46tables -A nixos-fw -p udp --dport ${range} -j nixos-fw-accept ${optionalString (iface != "any") "-i ${iface}"}
          ''
        ) cfg.allowedUDPPortRanges
      ) (cfg.interfaces // {any={allowedUDPPortRanges = cfg.allowedUDPPortRanges;};}))}
  
      # Accept IPv4 multicast.  Not a big security risk since
      # probably nobody is listening anyway.
  
negative.code:           ip46tables -A nixos-fw -p udp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "any") "-i ${iface}"}
          ''
        ) cfg.allowedUDPPorts
      ) allInterfaces)}
  
      # Accept packets on the allowed UDP port ranges.
      ${concatStrings (mapAttrsToList (iface: cfg:
  