something like:
iptables -A OUTPUT -m conntrack --ctstate NEW -m owner --uid-owner 100 -s 192.168.0.0/24 -j DROP
for 10's 172's 192's & 169's
Alternative:
allow ONLY villager network traffic to tmate's servers. We would need a list of the tmate server's addresses though