anchor.diff:              ${iptables} -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
   
               # Accept connections to the allowed TCP ports.            
  -            ${pkgs.lib.concatMapStrings (port:
  +            ${concatMapStrings (port:
                   ''
                     ${iptables} -A INPUT -p tcp --dport ${toString port} -j ACCEPT
                   ''
  
positive.code:   # doesn't deal with such Upstart jobs properly (it starts them if
    # they are changed, regardless of whether the start condition
    # holds).
    config = pkgs.lib.mkIf config.networking.firewall.enable {
  
      environment.systemPackages = [pkgs.iptables];
  
      jobs = pkgs.lib.singleton
        { name = "firewall";
  
          startOn = "network-interfaces/started";
  
negative.code: { config, pkgs, ... }:
  
  with pkgs.lib;
  
  let
  
    iptables = "${pkgs.iptables}/sbin/iptables";
  
    cfg = config.networking.firewall;
  
  in
  
  