# let DNS traffic from www-data pass to hvlan
ipt -A out_hvlan -p udp -m udp --dport 53 -m owner --uid-owner 33 -j ACCEPT

# drop everything else
ipt -A out_hvlan -m owner --uid-owner 33 -j DROP