should prevent all new tcp connection TO ssh ports on other servers when initiated locally (the forward chain is again another story)
But the point that I was trying to make was that that would then also block you from using SSH. If you want to connect to any external service, you need to open a port for it, and if there's an open port, then there's a opening for unintended escape.
so … one could run an http/s proxy under a specific user account, block all outgoing connections except those of that proxy (i.e. squid) then every program that wants to connect somewhere using direct ip connections would have to use that proxy.
I don't fully understand what this is trying to accomplish.