ufw: restrict outgoing commands