*filter
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
# prevent transmission daemon from doing anything outside it's
# network namespace.
-A OUTPUT -m owner --uid-owner debian-transmission -j REJECT
COMMIT