# create new table called "restricted_user"
iptables -t filter -N restricted_user
# add an OUTPUT rule to send traffic from $USENRAME to the restricted_user table
iptables -t filter -A OUTPUT -m owner --uid-owner $USERNAME -j restricted_user
# allow traffic on localhost
iptables -t filter -A restricted_user -o lo -j ACCEPT
# reject all other traffic
iptables -t filter -A restricted_user -j REJECT --reject-with admin-prohib
# drop all traffic if rejecting failed (this shouldn't be necessary but just to be sure)
iptables -t filter -A restricted_user -j DROP