tcp_deny should work