anchor.diff:        before = [ "network-pre.target" ];
         after = [ "systemd-modules-load.service" ];
   
  -      path = [ pkgs.iptables ] ++ cfg.extraPackages;
  +      path = [ cfg.package ] ++ cfg.extraPackages;
   
         # FIXME: this module may also try to load kernel modules, but
         # containers don't have CAP_SYS_MODULE.  So the host system had
  
positive.code: 
      networking.firewall.trustedInterfaces = [ "lo" ];
  
      environment.systemPackages = [ pkgs.iptables ] ++ cfg.extraPackages;
  
      boot.kernelModules = (optional cfg.autoLoadConntrackHelpers "nf_conntrack")
        ++ map (x: "nf_conntrack_${x}") cfg.connectionTrackingModules;
  
negative.code:           '';
        };
  
        package = mkOption {
          type = types.package;
          default = pkgs.iptables;
          example = pkgs.iptables-compat;
          description =
            ''
              The iptables package to use for running the firewall service."
            '';
        };
  
        logRefusedConnections = mkOption {
          type = types.bool;
          default = true;
  