Phil Whineray - 2012-03-17

Use DENY, not TARPIT on OUTPUT chain