diff --git a/README.md b/README.md
index a323eb4..4177df5 100644
--- a/README.md
+++ b/README.md
@@ -737,9 +737,10 @@ traffic. Static mode uses
 `LAB_PIMOX_WORKER_DNS_SERVERS="192.168.100.89 1.1.1.1"`.
 For static workers, Jeannie also adds targeted Pimox-host forwarding exceptions
 for each worker IP in `DOCKER-USER` when that chain exists, or `FORWARD`
-otherwise. Disable this with `LAB_PIMOX_WORKER_CONFIGURE_FORWARDING=false` only
-when the Pimox host firewall already permits bridged worker IP traffic. Before
-adding rules, Jeannie saves `iptables-save` output on the Pimox host under
+otherwise. If `iptables` is missing on the Pimox host, Jeannie installs it before
+adding those rules. Disable this with `LAB_PIMOX_WORKER_CONFIGURE_FORWARDING=false`
+only when the Pimox host firewall already permits bridged worker IP traffic.
+Before adding rules, Jeannie saves `iptables-save` output on the Pimox host under
 `${LAB_PIMOX_WORKER_IPTABLES_BACKUP_DIR:-~/iptables-backups}`.
 Worker NIC MAC addresses default to the VMID-derived deterministic format used
 by the original working Pimox worker path. Set `LAB_PIMOX_WORKER_MAC_MODE=auto`
diff --git a/README.md.tmpl b/README.md.tmpl
index 3c1f61c..d705b97 100644
--- a/README.md.tmpl
+++ b/README.md.tmpl
@@ -737,9 +737,10 @@ traffic. Static mode uses
 `LAB_PIMOX_WORKER_DNS_SERVERS="192.168.100.89 1.1.1.1"`.
 For static workers, Jeannie also adds targeted Pimox-host forwarding exceptions
 for each worker IP in `DOCKER-USER` when that chain exists, or `FORWARD`
-otherwise. Disable this with `LAB_PIMOX_WORKER_CONFIGURE_FORWARDING=false` only
-when the Pimox host firewall already permits bridged worker IP traffic. Before
-adding rules, Jeannie saves `iptables-save` output on the Pimox host under
+otherwise. If `iptables` is missing on the Pimox host, Jeannie installs it before
+adding those rules. Disable this with `LAB_PIMOX_WORKER_CONFIGURE_FORWARDING=false`
+only when the Pimox host firewall already permits bridged worker IP traffic.
+Before adding rules, Jeannie saves `iptables-save` output on the Pimox host under
 `${LAB_PIMOX_WORKER_IPTABLES_BACKUP_DIR:-~/iptables-backups}`.
 Worker NIC MAC addresses default to the VMID-derived deterministic format used
 by the original working Pimox worker path. Set `LAB_PIMOX_WORKER_MAC_MODE=auto`
diff --git a/bootstrap/provisioning/README.md b/bootstrap/provisioning/README.md
index c196983..8fc9460 100644
--- a/bootstrap/provisioning/README.md
+++ b/bootstrap/provisioning/README.md
@@ -152,9 +152,10 @@ Static mode uses
 and `LAB_PIMOX_WORKER_DNS_SERVERS="192.168.100.89 1.1.1.1"`.
 For static workers, Jeannie also adds targeted Pimox-host forwarding exceptions
 for each worker IP in `DOCKER-USER` when that chain exists, or `FORWARD`
-otherwise. Disable this with `LAB_PIMOX_WORKER_CONFIGURE_FORWARDING=false` only
-when the Pimox host firewall already permits bridged worker IP traffic. Before
-adding rules, Jeannie saves `iptables-save` output on the Pimox host under
+otherwise. If `iptables` is missing on the Pimox host, Jeannie installs it before
+adding those rules. Disable this with `LAB_PIMOX_WORKER_CONFIGURE_FORWARDING=false`
+only when the Pimox host firewall already permits bridged worker IP traffic.
+Before adding rules, Jeannie saves `iptables-save` output on the Pimox host under
 `${LAB_PIMOX_WORKER_IPTABLES_BACKUP_DIR:-~/iptables-backups}`.
 Worker NIC MAC addresses default to the VMID-derived deterministic format used
 by the original working Pimox worker path. Set `LAB_PIMOX_WORKER_MAC_MODE=auto`
diff --git a/jeannie b/jeannie
index 4a0f30d..a07bf1a 100755
--- a/jeannie
+++ b/jeannie
@@ -1070,16 +1070,15 @@ pimox_worker_vm_debug() {
     local key_path="$3"
     local vmid="$4"
     local qm_bin="$5"
+    local script
+    local encoded_script
 
-    pimox_ssh "${host}" "${user}" "${key_path}" "set +e
-echo 'Pimox VM ${vmid} status:'
-sudo '${qm_bin}' status '${vmid}'
-echo 'Pimox VM ${vmid} config summary:'
-sudo '${qm_bin}' config '${vmid}' | grep -E '^(agent|boot|net0|scsi0|virtio0|sata0|ide0|ide2|efidisk0):' || true
-echo 'Pimox VM ${vmid} guest-agent network-get-interfaces:'
-sudo '${qm_bin}' guest cmd '${vmid}' network-get-interfaces || true
-echo 'Pimox VM ${vmid} guest SSH diagnostics:'
-sudo '${qm_bin}' guest exec '${vmid}' -- bash -lc 'set +e
+    script="$(cat <<'EOF'
+set +e
+echo "-- addresses --"
+ip -br addr
+echo "-- routes --"
+ip route
 echo "-- units --"
 systemctl is-active ssh sshd 2>/dev/null || true
 echo "-- listeners --"
@@ -1088,7 +1087,18 @@ echo "-- sshd config test --"
 sudo sshd -t 2>&1 || true
 echo "-- recent ssh logs --"
 journalctl -u ssh -u sshd --no-pager -n 40 2>/dev/null || true
-' || true" >&2 || true
+EOF
+)"
+    encoded_script="$(printf '%s' "${script}" | base64 | tr -d '\n')"
+    pimox_ssh "${host}" "${user}" "${key_path}" "set +e
+echo 'Pimox VM ${vmid} status:'
+sudo '${qm_bin}' status '${vmid}'
+echo 'Pimox VM ${vmid} config summary:'
+sudo '${qm_bin}' config '${vmid}' | grep -E '^(agent|boot|net0|scsi0|virtio0|sata0|ide0|ide2|efidisk0):' || true
+echo 'Pimox VM ${vmid} guest-agent network-get-interfaces:'
+sudo '${qm_bin}' guest cmd '${vmid}' network-get-interfaces || true
+echo 'Pimox VM ${vmid} guest SSH diagnostics:'
+sudo '${qm_bin}' guest exec '${vmid}' -- bash -lc \"printf '%s' '${encoded_script}' | base64 -d | sudo bash\" || true" >&2 || true
 }
 
 pimox_worker_guest_agent_recovery_hint() {
@@ -1575,8 +1585,15 @@ configure_pimox_worker_forwarding() {
 
     pimox_ssh "${pimox_host}" "${pimox_user}" "${pimox_key}" "set -eu
 if ! command -v iptables >/dev/null 2>&1; then
-  echo 'iptables not found on Pimox host; skipping worker forwarding rules.'
-  exit 0
+  if command -v apt-get >/dev/null 2>&1; then
+    echo 'iptables not found on Pimox host; installing iptables for worker forwarding rules.'
+    sudo apt-get update
+    sudo apt-get install -y --no-install-recommends iptables
+  fi
+fi
+if ! command -v iptables >/dev/null 2>&1; then
+  echo 'iptables not found on Pimox host and could not be installed; cannot configure worker forwarding rules.' >&2
+  exit 1
 fi
 backup_dir='${backup_dir}'
 case \"\$backup_dir\" in
@@ -1589,6 +1606,9 @@ if command -v iptables-save >/dev/null 2>&1; then
   sudo iptables-save >\"\$backup_file\"
   echo \"Saved Pimox iptables backup: \$backup_file\"
 fi
+sudo mkdir -p /etc/sysctl.d
+printf '%s\n' 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-homelab-pimox-worker-forwarding.conf >/dev/null
+sudo sysctl -w net.ipv4.ip_forward=1 >/dev/null
 chain=FORWARD
 if sudo iptables -S DOCKER-USER >/dev/null 2>&1; then
   chain=DOCKER-USER