dist-upgrade is called full-upgrade now
we're already root, don't need sudo
use iptables-persistent package rather than shell scripts, add ipv6 firewall
change default ipv4 fw policy to DROP