anchor.diff:            '';
         };
   
  +      package = mkOption {
  +        type = types.package;
  +        default = pkgs.iptables;
  +        example = pkgs.iptables-compat;
  +        description =
  +          ''
  +            The iptables package to use for running the firewall service."
  +          '';
  +      };
  +
         logRefusedConnections = mkOption {
           type = types.bool;
           default = true;
  
positive.code:       before = [ "network-pre.target" ];
        after = [ "systemd-modules-load.service" ];
  
        path = [ pkgs.iptables ] ++ cfg.extraPackages;
  
        # FIXME: this module may also try to load kernel modules, but
        # containers don't have CAP_SYS_MODULE.  So the host system had
  
negative.code: 
      networking.firewall.trustedInterfaces = [ "lo" ];
  
      environment.systemPackages = [ cfg.package ] ++ cfg.extraPackages;
  
      boot.kernelModules = (optional cfg.autoLoadConntrackHelpers "nf_conntrack")
        ++ map (x: "nf_conntrack_${x}") cfg.connectionTrackingModules;
  