anchor.diff:          '';
       };
   
  +    networking.firewall.extraPackages = mkOption {
  +      default = [ ];
  +      example = [ pkgs.ipset ];
  +      description =
  +        ''
  +          Additional packages to be included in the environment of the system
  +          as well as the path of networking.firewall.extraCommands.
  +        '';
  +    };
  +
       networking.firewall.extraStopCommands = mkOption {
         type = types.lines;
         default = "";
  
positive.code:       before = [ "network-pre.target" ];
        after = [ "systemd-modules-load.service" ];
  
        path = [ pkgs.iptables ];
  
        # FIXME: this module may also try to load kernel modules, but
        # containers don't have CAP_SYS_MODULE. So the host system had
  
negative.code: 
      networking.firewall.trustedInterfaces = [ "lo" ];
  
      environment.systemPackages = [ pkgs.iptables ] ++ cfg.extraPackages;
  
      boot.kernelModules = map (x: "nf_conntrack_${x}") cfg.connectionTrackingModules;
      boot.extraModprobeConfig = optionalString (!cfg.autoLoadConntrackHelpers) ''
  