Your iptables setup looks correct to me. I'd suggest to remove
Code:
iptables --append OUTPUT --protocol icmp --jump ACCEPT
and then ping an IP from the blocklist.

IPTABLES_SETTINGS should be 2 if you use blockcontrol's custom iptables insert script. Or do you do this manually?


Besides that I'd suggest to use the MARKing feature for blocked packets, so that outgoing packets are REJECTed, instead of DROPped.

BTW, I see no target in this line:
Code:
# SSH
iptables --append INPUT --protocol tcp --dport 22