task
start on x1

script
iptables -F
iptables -P FORWARD DROP
iptables -A OUTPUT -p all -m owner --uid-owner lu -j DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -p tcp --dport ssh -j DROP
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -j DROP
end script

console output