fix: harden firewall and traffic reconciliation

tools/build.sh

@@ -37,6 +37,7 @@ BUILD_PACKAGES=(
 
 RUNTIME_PACKAGES=(
   iproute2
+  iptables
   nftables
   kmod
   util-linux
@@ -381,11 +382,12 @@ Section: net
 Priority: optional
 Architecture: amd64
 Maintainer: AWG2 Harness
-Depends: libc6, iproute2, nftables, kmod, util-linux, procps, systemd
+Depends: libc6, iproute2, iptables, nftables, kmod, util-linux, procps, systemd
 Description: Host-side orchestrator for AmneziaWG traffic shaping and lifecycle recovery
  AWG2 Harness manages AmneziaWG traffic shaping, IFB ingress shaping,
- nftables anti-torrent guard, reboot scheduling, swap setup and daemonized
- drift recovery on dedicated Debian hosts. Includes external reboot scheduler.
+ iptables host firewall, nftables anti-torrent guard, reboot scheduling,
+ swap setup and daemonized drift recovery on dedicated Debian hosts.
+ Includes external reboot scheduler.
 EOF
 
   cat >"$staging/DEBIAN/postinst" <<'EOF'
@@ -406,7 +408,7 @@ echo "Then run preflight before enabling services:"
 echo "  awg2-harness --config /etc/awg2-harness/config.toml validate-config"
 echo "  awg2-harness --config /etc/awg2-harness/config.toml validate-runtime"
 echo "  awg2-harness --config /etc/awg2-harness/config.toml status"
-echo "Enable services only after SSH, Amnezia port and peer CIDR are verified."
+echo "Enable services only after SSH, expected Amnezia UDP port and peer CIDR are verified."
 echo "  systemctl enable --now awg2-harness.service awg2-reboot-scheduler.service"
 
 exit 0