• it does not include possible necessary BOINC IPs
  
• The DNS rule may be restricted to certain DNS servers (google's DNS 8.8.8.8 and 8.8.4.4 for instance)
  

# set DROP default policy
iptables -P INPUT   DROP
iptables -P OUTPUT  DROP
iptables -P FORWARD  DROP

#Allow loopback interface
iptables -A INPUT -i lo  -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A FORWARD -i lo -j ACCEPT

#Allow DNS for DNS queries containing the word "worldcomunitygrid" 
iptables -A OUTPUT  -p udp --sport 53 -m string --algo bm --string worldcommunitygrid  -j ACCEPT
iptables -A INPUT  -p udp --dport 53  -m string --algo bm --string worldcommunitygrid  -j ACCEPT
iptables -A OUTPUT  -p udp --dport 53  -m string --algo bm --string worldcommunitygrid -j ACCEPT
iptables -A INPUT  -p udp --sport 53  -m string  --algo bm --string worldcommunitygrid -j ACCEPT

# allow WCG IPs 
for IP in  198.20.8.246 198.20.8.241
do
    for PORT in 443 80
        do
iptables -A INPUT -p tcp --dport $PORT -s $IP -j ACCEPT
iptables -A OUTPUT -p tcp --sport $PORT -d $IP -j ACCEPT
       done
done