this matches the version used on our hosts -preview is used because buster (including the newer nf_tables backend for iptables) isn't available in stretch