anchor.diff:  let
   
     cfg = config.networking.firewall;
  +
  +  helpers =
  +    ''
  +      # Helper command to manipulate both the IPv4 and IPv6 tables.
  +      ip46tables() {
  +        iptables "$@"
  +        ip6tables "$@"
  +      }
  +    '';
   
   in
   
  
positive.code: 
          preStart =
            ''
              # Helper command to manipulate both the IPv4 and IPv6 tables.
              ip46tables() {
                iptables "$@"
                ip6tables "$@"
              }
  
              ip46tables -F INPUT
              ip46tables -F FW_REFUSE || true
              ip46tables -X # flush unused chains
              ip46tables -P INPUT ACCEPT
  
  
              # The "FW_REFUSE" chain performs logging and
              # rejecting/dropping of packets.
              ip46tables -N FW_REFUSE
  
              ${optionalString cfg.logRefusedConnections ''
                ip46tables -A FW_REFUSE -p tcp --syn -j LOG --log-level info --log-prefix "rejected connection: "
              ''}
              ${optionalString cfg.logRefusedPackets ''
                ip46tables -A FW_REFUSE -j LOG --log-level info --log-prefix "rejected packet: "
              ''}
  
              ${if cfg.rejectPackets then ''
                # Send a reset for existing TCP connections that we've
                # somehow forgotten about.  Send ICMP "port unreachable"
                # for everything else.
                ip46tables -A FW_REFUSE -p tcp ! --syn -j REJECT --reject-with tcp-reset
                ip46tables -A FW_REFUSE -j REJECT
              '' else ''
                ip46tables -A FW_REFUSE -j DROP
              ''}
  
  
              # Accept all traffic on the loopback interface.
              ip46tables -A INPUT -i lo -j ACCEPT
  
              # Accept packets from established or related connections.
              ip46tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  
              # Accept connections to the allowed TCP ports.
              ${concatMapStrings (port:
                  ''
                    ip46tables -A INPUT -p tcp --dport ${toString port} -j ACCEPT
                  ''
                ) cfg.allowedTCPPorts
              }
  
negative.code:             # Accept packets on the allowed UDP ports.
              ${concatMapStrings (port:
                  ''
                    ip46tables -A nixos-fw -p udp --dport ${toString port} -j nixos-fw-accept
                  ''
                ) cfg.allowedUDPPorts
              }
  
              # Accept IPv4 multicast.  Not a big security risk since
              # probably nobody is listening anyway.
              #iptables -A nixos-fw -d 224.0.0.0/4 -j nixos-fw-accept
  
              # Optionally respond to ICMPv4 pings.
              ${optionalString cfg.allowPing ''
                iptables -A nixos-fw -p icmp --icmp-type echo-request -j nixos-fw-accept
              ''}
  
              # Accept all ICMPv6 messages except redirects and node
              # information queries (type 139).  See RFC 4890, section
              # 4.4.
              ip6tables -A nixos-fw -p icmpv6 --icmpv6-type redirect -j DROP
              ip6tables -A nixos-fw -p icmpv6 --icmpv6-type 139 -j DROP
              ip6tables -A nixos-fw -p icmpv6 -j nixos-fw-accept
  
              ${cfg.extraCommands}
  
              # Reject/drop everything else.
              ip46tables -A nixos-fw -j nixos-fw-log-refuse
  
  
              # Enable the firewall.
              ip46tables -A INPUT -j nixos-fw
            '';
  
          postStop =
            ''
              ${helpers}
              ip46tables -D INPUT -j nixos-fw || true
              #ip46tables -P INPUT ACCEPT
            '';
        };
  
  