anchor.diff:  
           preStart =
             ''
  -            # Helper command to manipulate both the IPv4 and IPv6 filters.
  +            # Helper command to manipulate both the IPv4 and IPv6 tables.
               ip46tables() {
                 iptables "$@"
                 ip6tables "$@"
  
positive.code:   # doesn't deal with such Upstart jobs properly (it starts them if
    # they are changed, regardless of whether the start condition
    # holds).
    config = mkIf config.networking.firewall.enable {
  
      environment.systemPackages = [ pkgs.iptables ];
  
  
negative.code:       default = false;
        description =
          ''
            Whether to enable the firewall.  This is a simple stateful
            firewall that blocks connection attempts to unauthorised TCP
            or UDP ports on this machine.  It does not affect packet
            forwarding.
          '';
      };
    
  