Blocking outgoing traffic in sys-* VMs

Using nftables, the locally generated traffic is usually governed by chains attached to the OUTPUT hook, while the forwarded traffic is going thru the FORWARD-hooked chain(s).

That is, unless you proxy traffic (e.g., socks), in which case the proxy’d traffic is also going through OUTPUT too.

See the Netfilter Hooks Wiki page for a nice overview.