firewall: keep the forwarding tables policy at DROP but add rules to allow specific traffic
debian-purge: also invoke 'apt-get autoremove'