# init logging chain
iptables -N LOGGING

# allow all for firefox
#iptables -A OUTPUT -p tcp -m owner --uid-owner 1001 -j ACCEPT

# allow localhost
iptables -A OUTPUT -d 127.0.0.1/8 -p tcp -j ACCEPT
iptables -A OUTPUT -d 127.0.0.1/8 -p udp -j ACCEPT

# source file with exceptions
bash /root/ip-excp.sh

# meh
iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# log the rest
iptables -A OUTPUT -j LOGGING
iptables -A LOGGING -j LOG --log-prefix "OUT packet " --log-uid
iptables -A LOGGING -j ACCEPT